Endpoint security for
regulated organizations.
Threat detection, response, and your HIPAA, FERPA, and GLBA evidence in one agent. The compliance reporting is built in, not a separate module.
Windows, macOS, and Linux · Source review under NDA · Runs on the hardware you already own
Measured 24 July 2026 on Windows 11, agent 13.1.0 release build, on one machine. Not a benchmark suite.
The HIPAA report is already done.
Every screen below is the shipping product. Native desktop app on Windows, macOS, and Linux.
One agent. One console. One bill.
Replaces separate AV, SIEM connector, compliance reporting, and audit log tooling.
Real-time detection
YARA rules, behavioral baselines, memory injection, script analysis
Auto-response playbooks
Isolate, quarantine, kill, notify, open a ticket
Compliance built in
HIPAA and FERPA control dashboards, GLBA Safeguards report
Tamper-evident audit trail
Hash-chained logs, satisfies §164.312(b)
PHI encrypted at rest
AES-256-GCM, satisfies §164.312(a)(2)(iv)
SIEM integration
Splunk HEC, Elasticsearch, Sentinel
Two people can deploy this.
No MDM. No professional services engagement. No rip-and-replace.
- Install how you already push software.
One signed MSI. Deploy it by GPO, login script, RMM, or a USB stick. Intune and SCCM work too — neither is required.
- It runs alongside Microsoft Defender.
Bastion installs as an ordinary Windows service and does not register itself as an antivirus product, so Defender stays enabled and keeps doing its job. Nothing to disable, nothing to exclude.
- It keeps working offline.
Detection continues with no connection. Events are cached on disk and drain in order when the link comes back. Relevant if you have buildings on bad uplinks.
- It runs on old hardware.
Measured on a normal Windows 11 desktop: 46 MB of memory and under 1% CPU in steady state. The 2016 OptiPlex at the nurse's station stays usable.
How Bastion compares
| Product | Price / endpoint / yr | Built-in HIPAA/FERPA dashboard |
|---|---|---|
| Microsoft Defender for Business | $36 / user | No |
| CrowdStrike Falcon Go | $60 | No |
| CrowdStrike Falcon Pro | $100 | No |
| Huntress Managed EDR | $108 | No |
| SentinelOne Singularity Complete | $180 | No |
| CrowdStrike Falcon Enterprise | $185 | No |
| Bastion EDR Professional | $67 | Built in |
Competitor figures are vendor-published list prices as observed 24 July 2026, annual billing, per endpoint unless noted. Defender for Business is priced per user and covers up to five devices each, so its per-device cost can be well below the others. SentinelOne's published price is quoted for 5–100 workstations and sold through partners. Bastion Professional: $67/endpoint/year. The compliance column compares shipped dashboards, not HIPAA suitability — every vendor here can be run in a HIPAA environment.
Pricing
No compliance add-ons. No per-report fees. Annual billing saves 20%.
Professional
Up to 2,000 endpoints
or $67/endpoint billed annually
- ✓Everything in Starter
- ✓HIPAA dashboard
- ✓FERPA dashboard
- ✓SIEM integration (Splunk · Elastic · Sentinel)
- ✓Auto-response playbooks
- ✓Tamper-evident audit logs
- ✓Breach notification workflow
- ✓PHI encryption at rest (AES-256-GCM)
Starter
Up to 500 endpoints
or $48/endpoint billed annually
- ✓Full EDR — detection and response
- ✓MITRE ATT&CK coverage
- ✓Real-time alerts
- ✓Software inventory
- ✓Email support
Enterprise
Unlimited endpoints
Contact sales for volume pricing
- ✓Everything in Professional
- ✓Custom SLA
- ✓On-premises option
- ✓Dedicated onboarding
- ✓MSP multi-tenant management
1,200 managed machines on Professional: $80,400/year, compliance reporting included.
Start a 25-endpoint evaluation.
Fourteen days with every Professional feature enabled. Download link and license key within one business day. No credit card, no sales call.
- Evaluation licence
- Download link and key within one business day
- Source review
- Read access granted for security audit, under NDA
- Deployment
- One signed MSI — GPO, SCCM, Intune, RMM, or removable media
- Platforms
- Windows, macOS, and Linux
- Data at rest
- PHI encrypted with AES-256-GCM; tamper-evident audit log
- Direct contact
- [email protected] — for anything a web form cannot carry
Schools, clinics, and other regulated organizations are quoted a quarter million a year for tools built for companies that staff a security operations centre. The obligation is identical. The product on offer is not.
Bastion is built and supported by Halden Technologies. Requests submitted through this form, or sent to [email protected], reach an engineer directly.