Create your account
Open Create Account, enter your email and password, and verify the email using the code sent to your inbox. Registration is not complete until the verification code is accepted.
User Manual
Set up Guardian, download the installer, and operate the app with confidence.
Practical playbook for the open-source edition: account + download, alert response, baselines, and troubleshooting. For architecture and model internals, use the technical reference.
5
Core setup steps from account creation to first protected device
4
Alert tiers: Monitoring, Under Review, Investigation Required, and Action Required
2
On-device detection layers working together on one machine
Local
Core detection inference runs on-device without required cloud scoring
01 — Quick Start
The shortest path to a working Guardian install
If you only need the practical setup path, follow these five steps in order. This matches the current live website and desktop flow.
Sign in and open Download
After verification, sign in and open Download or My Account. A free account is required to download the Windows installer from this site.
Download the Windows app
Use the download button to fetch the latest Windows installer (saved to your Downloads folder). Install it on each Windows device you want to monitor.
Complete first-run setup
On first launch, follow the in-app setup: accept terms, confirm experimental posture, and let the elevated monitor start. No activation token is required in the open-source edition.
Record baselines (recommended)
On a clean, stable machine, record per-app or whole-system baselines so Guardian can personalize local thresholds. See the Baselines section below.
02 — Account
What the website account area is for
The website handles registration, sign-in, password resets, and authenticated installer download. Core detection runs on-device under AGPL-3.0.
Registration and sign-in
- Registration uses email plus password only.
- Email verification is part of account creation.
- The sign-in page is the entry point for existing users.
- If you forget your password, use the reset flow and the emailed reset code.
My Account page
- View your sign-in email and change your password.
- Download Guardian for Windows (auth-gated).
- Manage session sign-out from the header menu.
Website account (OSS)
- A free account is required to download the Windows installer from /download.
- Use My Account for email, password, and installer download — not per-device licensing.
- Install Guardian on each PC you want to protect; no activation token in the open-source build.
03 — Desktop App
What each desktop area is for
The Windows app is organized into main sidebar views. After first-run setup, the dashboard and alerts are available immediately — no subscription gate in the open-source edition.
Dashboard
Shows overall protection state, counts for Investigation Required and Action Required, Under Review summaries, and a tier-marked timeline for recent activity.
Alerts
Shows actionable review lanes (user-installed and newly discovered executables), plus dedicated tabs for Windows OS, signed software, hardware processes, and background monitoring.
Investigation Required
Deviation Tier 3 work that is not yet operational Tier 4: review evidence, use Suggested Actions on protected categories, and wait for corroboration before destructive steps.
Action Required
Operational Tier 4 only: corroborated escalation that needs an immediate decision. Use Respond for guided steps and hand off to Windows Security — the OSS edition does not quarantine files.
Configuration Posture
Compares local snapshots of Defender, firewall, and related Windows settings against a reference you establish. Drift and unacknowledged incidents can surface review items.
Baseline Recordings
Where you record trusted per-app or whole-system clean behavior so Guardian can personalize local thresholds on your PC.
Settings
Used for global sensitivity, monitor-only behavior, and other device-side operating preferences. Use Check for Updates to install the latest build from the same release channel as the website installer (no in-app browser checkout).
04 — Alerts
How Guardian classifies, escalates, and responds to suspicious activity
Guardian uses local anomaly scores to move activity through review tiers. Different process categories expose different actions so the app does not offer unsafe remediation for Windows or driver components.
Background Monitoring
A process has been flagged at least once, but not strongly enough to demand immediate action. Guardian keeps watching it quietly.
Under Review
Suspicious behavior is becoming consistent. User-installed processes appear in actionable review lanes; protected system categories stay in their own tabs. You can Acknowledge to return a card to monitoring; it may re-escalate if activity continues.
Investigation Required
Strong sustained deviation from baseline: a behavioral signal, not a final verdict. Work is routed to the Investigation Required sidebar view so you can review evidence before any destructive step.
Action Required
Operational Tier 4 only: corroborated escalation (for example correlated secondary indicators or Defender-confirmed routing). Use Respond for step-by-step guidance.
Alert lanes you will see
- Actionable Alerts: Tier 2 user-installed processes and newly discovered executables that need review.
- Investigation Required: deviation Tier 3 follow-up before operational Tier 4.
- Action Required: operational Tier 4 only; immediate decisions when corroboration clears the bar.
- Windows OS Processes: core Windows components — use Suggested Actions, not automated enforcement.
- Signed Software: known vendor software behaving unexpectedly.
- Hardware Processes: driver and peripheral vendor software — use manufacturer guidance to avoid destabilizing the system.
- Behavioral pattern alerts: system-level suspicious patterns that are not tied to one executable file.
- Background Monitoring: Tier 1 processes under quiet observation.
What the action buttons mean
- Respond: step-by-step guide on Action Required cards — review evidence and hand off to Windows Security (OSS edition).
- Investigate: opens the behavioral-pattern explanation and investigation guidance.
- Acknowledge: moves the alert back to monitoring while keeping the process under watch.
- Dismiss: removes the alert from active monitoring until a future anomaly creates a new alert.
- Suggested Actions / Open Windows Security: directs remediation for Windows, signed, hardware, or Defender-confirmed cases.
05 — Baselines
How local personalization works
Guardian ships with fixed ONNX models. Local recordings do not retrain model weights; they derive bounded local thresholds on your machine so Guardian can better separate trusted behavior from true anomalies.
Per-application baseline
Record a clean lifecycle for one trusted executable. This is the right tool when one app repeatedly raises false positives and you want Guardian to learn a tighter local envelope for that process on your PC.
Whole-system baseline
Record a machine state you trust. This can expand process coverage and contribute clean behavioral windows for the slower machine-wide layer. Use it only on a clean, stable system state you actually trust.
Merge and re-record
If a trusted application changes meaningfully over time, recording again can improve local coverage. Guardian treats the resulting baseline information as additive local context rather than a model-weight change.
Monitor Only Mode
Useful when you want to observe without prompting response actions. Alerts still surface; you review conservatively before using Respond.
06 — Support + Troubleshooting
What to do when the flow does not go as expected
Most issues fall into a few predictable buckets: email delivery, download/sign-in, SmartScreen or Defender friction, or alert interpretation. Start with the simplest explanation first.
I did not get a verification or reset email
Check spam or filtered folders first. If the website flow says the request was accepted but the message never arrives, use the support form and include the email address you used.
I cannot download the installer
Sign in on the website, open Download or My Account, and use the download button. If you are signed out, create a free account first — the download page will gate until you are authenticated.
Older commercial builds
If you still run a legacy commercial installer, you may see activation UI. Download the latest open-source build from Download to use the AGPL edition without subscription gates.
I think an alert is a false positive
Open Information on the card first. If the process is trusted, Acknowledge can move it back to monitoring, and a clean baseline recording can make future evaluation more accurate on your PC.
Windows Defender or SmartScreen blocked Guardian
Guardian is not yet code-signed with a publisher certificate, so Windows may flag the installer or monitor as unknown software. Download only from this website, use More info → Run anyway on SmartScreen if needed, and add a Defender exclusion for %LOCALAPPDATA%\AI Malware Guardian\ if the monitor is quarantined. You can submit a false-positive report to Microsoft if desired.
Games, launchers, or dev tools trigger alerts
Elevated or automation-heavy workloads can surface Under Review or Investigation Required. Action Required stays corroboration-gated. Use Information and baseline recordings before taking remediation steps on trusted tools.
What stays local
The detection engine runs on-device. Account and support actions use the website when you choose; Guardian does not depend on cloud-hosted behavior scoring for local evaluation.
Where to get help
Use the Support page for account, billing, setup, or technical issues. If the form is unavailable, the documented fallback path is support@aimalwareguardian.com.
Check for Updates or reinstall
In Settings → Check for Updates, install the latest build from the same channel as the website. If the monitor will not start after Defender quarantine, reinstall from your account download and re-activate if needed.