Day 1 — Foundation

• Create MSP org and first client org

• Invite analyst seats (role-based access)

• Download XISEM Agent MSI and Anti-Venom from dual-strike.com/downloads

• Deploy agent to 3–5 pilot endpoints (mix of desktop + laptop)

Day 2 — Browser coverage

• Confirm Anti-Venom from Chrome Web Store / Edge Add-ons / Firefox AMO (8.7.x GA line)

• Publish browser policy in Settings → Browser Extension

• Open Browsing Insights — verify sessions within 24h

• Check Extension Health — aim for Healthy, not Not Detected on active machines

Day 3 — Identity

• Establish Microsoft GDAP (or client-specific identity infeed)

• Validate Entra sign-ins on Asset timelines

• Skim Conditional Access intelligence panel — no enforcement, just context

Day 4 — EDR and PSA

• Connect primary EDR (SentinelOne, CrowdStrike, Huntress, etc.)

• Connect PSA (ConnectWise, Autotask, Halo, SuperOps, …)

• Fire test detection → confirm ticket creates with evidence body

Day 5 — Detection tuning

• Enable COBRA² rules in learning mode: shadow AI, posture regression, identity drift

• Review Threat Center volume — disable noisy rules

• Map severities to PSA boards

Day 6 — Compliance and reporting

• Select target framework (SOC 2, NIST, CMMC, …)

• Review initial control gaps

• Schedule first monthly executive report

Day 7 — Client readout

• Walk client through Asset modal on one device (live demo)

• Show Browsing Insights top domains + AI usage

• Agree remediation priorities from POA&M top items

Success metrics at day 7

MetricGood sign Agent coverage>80% of managed endpoints in pilot Extension healthActive users reporting Healthy/Idle Identity eventsSign-ins visible for M365 clients PSA loopAt least one ticket round-trip Detections<5 false-positive Criticals after tuning

Deep dives: Evidence doctrine · COBRA² guide · GDAP onboarding

Adjust pacing for client size — enterprise may need 14 days for change windows.

> STAP note: EDR gateways are Strategic Technology Alliances under the Strategic Technology Alliance Program (STAP). XISEM extends and operationalizes EDR telemetry — it is not an EDR replacement.

Dual-Strike XISEM is not an EDR replacement. It is the correlation and governance layer that extends and operationalizes the EDR you already sell. EDR alliance gateways import detections, agent health, and asset mappings so COBRA², ASPIRE, and Threat Center see the same device the SOC already manages.

Route: Settings → Technology Alliances → EDR

Supported EDR families (public index)

VendorTypical MSP use SentinelOneMSP multi-tenant, Singularity API CrowdStrike FalconEnterprise and mid-market HuntressSMB-focused managed EDR Microsoft Defender for EndpointM365-heavy clients Trend Micro, Sophos, othersSee Technology Alliances wiki slug index

Exact setup steps live in Support wiki → Technology Alliances per vendor (API keys, OAuth, site IDs).

What XISEM adds on top of EDR

1. Asset reconciliation — EDR agent ID ↔ XISEM agent ↔ Entra user

2. Unified Threat Center — EDR + COBRA + FIM + browsing in one queue

3. Compliance mapping — EDR evidence satisfies endpoint protection controls

4. PSA tickets — detection → ticket with cross-source context

5. ASPIRE Security pillar — gap when EDR missing on managed asset

Deployment order

1. XISEM agent on endpoints (posture + browsing + FIM path)

2. EDR as today (keep vendor console for containment)

3. Enable EDR infeed per client

4. Tune duplicate suppression — same malware signal from EDR and COBRA may merge

Field note: coverage truth

Extension Health and EDR health together answer: “Is this laptop actually protected?” An EDR agent without XISEM agent misses browsing and posture correlation. XISEM agent without EDR may still score ASPIRE but Security pillar reflects the gap honestly.

Docs: Technology Alliances → SentinelOne MSP · CrowdStrike Falcon · Huntress

Download agents: dual-strike.com/downloads

Vendor trademarks belong to their owners — integration availability subject to API terms.

Not every client stakeholder needs an analyst seat. The Client Portal exposes curated, read-only posture views: scheduled reports, compliance summary tiles, open remediation items, and optional browsing summaries — under MSP white-label branding.

Route: Settings → Client Portal · Support wiki → Client portal

What clients typically see

SurfaceStakeholder Executive dashboardOwner, CFO Published reportsIT manager Open POA&MRemediation owner Compliance %Auditor (read-only link)

What stays MSP-internal

• Threat Center full queue

• Raw browsing session detail (configurable)

• Cross-client MSP rollups

• Integration credentials

Portal scope is per client org — no neighbor tenant leakage.

Enablement checklist

1. Configure white-label logo and colors

2. Select portal modules to expose

3. Invite client users with portal role (email invite)

4. Publish first scheduled report to portal archive

5. QBR walkthrough live on portal URL

Sales angle

> “You get 24/7 visibility into posture and compliance progress — we retain operational control and PSA workflow.”

Differentiates from EDR vendor portals that show only their product silo.

Security posture

• Separate auth from MSP analyst accounts

• MFA recommended (Entra SSO when configured)

• Session timeout per platform defaults

Related: Reports and executive binders · Custom dashboards · White-label MSP branding wiki

Demo: dual-strike.com

Portal module list is configurable — ship only what the contract includes.

Threat Center is the operational heart of Dual-Strike XISEM for MSPs running multi-client fleets. It unifies COBRA² detections, file integrity (FIM) alerts, CVE correlation items, and integration health findings into a severity-sorted queue you can assign, investigate, and close.

Queue anatomy

Column / filterOperator use SeverityCritical → informational triage order Detection typeCOBRA, FIM, CVE, integration Client orgMSP multi-tenant scope Asset / identityPivot to Asset modal StatusOpen, investigating, remediated, closed PSA linkTicket ID when outfeed enabled

FIM in Threat Center

File integrity monitoring arrives with agent 8.8.x platform support (preview noted separately). FIM alerts surface alongside traditional detections so technicians do not maintain a second queue.

Typical FIM scenarios:

• Unauthorized change to hosts or critical system files

• New scheduled task or service binary

• Policy-defined paths on servers and privileged workstations

Each FIM item carries before/after hash context and asset linkage — not a raw syslog line.

PSA integration loop

Supported PSA/RMM outfeeds include ConnectWise, Autotask, Halo, SuperOps, Ninja, Syncro, and others (see Integrations wiki). Workflow:

1. Detection fires in Threat Center

2. Auto or manual ticket creation with evidence snippet

3. Technician remediates in client environment

4. Ticket closed in PSA → XISEM status sync

Daily standup ritual (5 minutes)

1. Sort Critical + High open items across all clients

2. Assign owner per ticket

3. Pivot any “unknown asset” rows to Inventory

4. Note recurring rule names for COBRA tuning this week

Route: /threat-center

Upgrade path: Agent 8.7.0.17 GA today · FIM capabilities in 8.8 release notes when promoted

Mock data only — Northwind Traders demo tenant.

Most security stacks blur three jobs into one noisy alert stream. Dual-Strike XISEM separates them on purpose — so your analysts investigate with context, not panic.

Collect — neutral facts only

XISEM Agents, Anti-Venom Secure Access, and infeeds (Microsoft 365, EDR, PSA, identity, network) deliver timestamped evidence. They do not render verdicts. They do not enforce access. They prove what happened on a device, in a browser, or in a cloud tenant.

Examples of collection (not interpretation):

• Agent posture harvest at check-in

• Browser session domain + duration from Anti-Venom

• Entra sign-in success/failure

• SentinelOne or CrowdStrike detection export

• ConnectWise ticket status change

Interpret — correlation and policy

The Dual-Strike XISEM platform correlates evidence across sources:

• COBRA² detection logic (rules, baselines, drift)

• ASPIRE posture scoring across six pillars

• Conditional Access intelligence at the client org level

• Compliance mapping to 100+ frameworks with control linkage

• MIP identity lifecycle and NHI governance signals

Evidence alone is never a verdict. Interpretation produces posture, detections, and compliance gaps — still advisory until a human or approved workflow acts.

Decide — analyst and operator actions

The console is an investigative surface, not an autonomous enforcer:

• Asset modal — timeline, matrices, extension health, pivots

• Threat Center — triage, assign, PSA ticket, remediate

• Investigations — case narrative with evidence chain

• Reports — executive binders and audit exports

PSA outfeeds close the loop: detection → ticket → technician work → status sync back into XISEM.

Why this matters for MSPs

When you onboard a client, you are not buying another alert generator. You are buying one correlated story across agent, browser, identity, and EDR — with compliance and CA context baked in.

Start here: dual-strike.com · Support wiki → Platform overview

Illustration uses anonymized demo tenant names only.

Extension Health answers the question every vCISO asks after deploying Anti-Venom: “Is it actually running on the browsers we care about?” It lives in Browsing Insights and the Asset modal, with tier logic designed to reduce weekend false alarms on spare laptops.

Tier definitions (operator-facing)

TierMeaningTypical action HealthyExtension reported within normal windowNone IdleNo extension ping 24–72h; agent may still check inVerify user on PTO / spare device StaleNo extension >72h; agent still presentSchedule revisit or decommission asset Not detectedAgent active <24h but no extensionDeploy/repair extension urgently

Key nuance: A laptop unused since Thursday should land Idle, not Not detected, when agent check-in is older than 24h but younger than 72h.

Orange banner semantics

The warning banner counts endpoints where:

• Agent is recently active (<24h), AND

• No extension has reported

It excludes long-idle spare machines from the urgent count — truthful coverage without noise.

By-browser columns

Users often run Edge + Chrome. Health is per browser, not per device:

• Edge Healthy + Chrome Not detected → reinstall Chrome extension only

• Both Not detected with active agent → GPO/store deployment issue

Rollout verification checklist

1. Deploy agent → wait for check-in

2. Install extension from official store listings (8.7.x line)

3. Browse one site → session in Browsing Insights within 15 min

4. Extension Health → Healthy

5. Repeat for second browser if dual-browser standard

Pair with COBRA²

Rule: “Extension gap on active user workstation” should fire only on Not detected + recent agent, not Idle spare pool.

Route: /browsing-insights → Extension Health tab

Related: Browsing Insights field guide · Anti-Venom Edge GA post

Illustrative demo data — tiers reflect 8.7.0.17 platform behavior.

Managed Identity Provider (MIP) is Dual-Strike XISEM’s identity governance surface. It correlates Entra ID, M365, PSA/HR signals, and platform detections so human and non-human identities (NHI) do not drift unnoticed.

Join — provision with evidence

• New hire appears in PSA or HR infeed (when integrated)

• Entra account created → first sign-in on Asset timeline

• MIP shows provisioned state with expected group memberships

• COBRA² can alert on over-privileged new accounts

Move — role change is the risky beat

Most incidents are not joiners — they are movers:

• Department change without group cleanup

• Old admin roles retained “temporarily”

• License downgrade but retained SharePoint access

MIP highlights delta between expected and actual entitlements after move events.

Leave — deprovision completely

• PSA offboarding ticket closed ≠ Entra disabled (verify both)

• MIP tracks disabled accounts, mailbox forwarding, active sessions

• Pair with Browsing Insights for OAuth grants that survive disable

NHI — service accounts and app registrations

Non-human identities include:

• Azure app registrations with secrets

• Service principals with Graph permissions

• Legacy service accounts with password never expires

MIP NHI panel (public marketing: dual-strike.com/mip) surfaces stale secrets, excessive API scopes, and ownerless apps.

vCISO monthly review (30 min)

1. Leavers last 30 days — all disabled in Entra?

2. Movers — any admin role accumulation?

3. NHI top 10 by privilege — owners assigned?

4. Export gaps to POA&M and PSA remediation project

Related: GDAP onboarding · Conditional Access intelligence · MIP NHI deep dive (post #4)

Identity evidence from infeeds — XISEM does not provision Entra directly.

Government and defense-industrial cybersecurity has a calendar problem.

Most programs can assemble a binder for an assessment window. Fewer can answer — today — whether they are audit-ready against the frameworks they contracted, which controls fail with proof, and which remediations will move posture this sprint.

Authorizing officials want trajectory. Assessors want evidence. Operators want actions. Spreadsheet POA&Ms and annual screenshot archaeology satisfy none of them for long.

Dual-Strike XISEM for Government (XISEM GOV) is the cyber operations platform for that reality: discover, secure, measure, and continuously prove compliance posture across mission systems, identities, endpoints, and enclaved workloads.

> One platform to discover, secure, measure, and continuously prove compliance posture across every mission system, identity, endpoint, and enclaved workload.

Explore: dual-strike.com/solutions/government

The government problem in plain language

Agencies, state programs, and Defense Industrial Base contractors drown in point tools. Each tool owns a slice of truth. None owns the program narrative.

The failure mode is predictable:

• NIST and CMMC readiness lives in a GRC spreadsheet that lags live systems by months.

• FedRAMP-family and StateRAMP programs scramble between 3PAO milestones instead of operating posture every day.

• Privileged access is still standing admin because “the maintenance window required it.”

• Browsing and SaaS risk — including Shadow AI and exfiltration-oriented behavior — sits outside the compliance story for Controlled Unclassified Information and export-sensitive work.

• When an assessor asks for proof, the answer is a folder of screenshots with no provenance chain.

XISEM GOV is not another SIEM that only stores logs, and it is not a GRC tool that only tracks policies. It turns live telemetry into defensible control evidence, plans of action and milestones (POA&M), and assessor-ready binders — every day.

GRC tracks intent. XISEM feeds evidence. They complement.

Built for framework-first missions

Government buyers are measured against frameworks — not feature lists. XISEM GOV maps evidence already in the platform to the programs those missions live under:

Program pressureMeetExceed NIST CSF / SP 800-53 / SP 800-171Live control mapping and daily evidence against the frameworks your program contractsASPIRE™ / MAVICE℠ trajectory an authorizing official or CISO can defend — not annual screenshot archaeology CMMC Levels 1–3Level-scoped packs, POA&M, and readable evidence chains for CUI environmentsRanked remediation that moves assessor outcomes this sprint — not spreadsheet theater FedRAMP / GovRAMP / StateRAMP / TX-RAMPFramework operations, binders, and accreditation-status tracking between 3PAO milestonesContinuous posture without claiming an authorization Dual-Strike has not officially attained

Framework center of gravity: NIST CSF 2.0 · NIST 800-171 · NIST 800-53 · CMMC L1–L3 · FedRAMP · GovRAMP · StateRAMP · TX-RAMP · ITAR-supporting program controls · DFARS cyber expectations

Meet the frameworks. Exceed the binder scramble.

What an authorizing official actually needs

Framework-first compliance

Select the contracted set — NIST CSF, 800-171, 800-53, CMMC, FedRAMP-family packs — and operate against that set with evidence refreshed daily. Framework mapping only hurts when it is a January spreadsheet. Tie controls to live telemetry and compliance becomes a running program, not a fire drill.

POA&M and binders with provenance

Remediation needs owners, due dates, and proof. XISEM GOV generates POA&M from live control failures and packages assessor-ready binders with mappings, evidence, and provenance — so the package is a product of operations, not a weekend of archaeology.

Secure Elevate — least privilege you can defend

Standing administrator rights are a recurring finding and a recurring incident path. Secure Elevate eliminates standing admin and replaces it with just-in-time elevation with evidence for privileged workflows — the kind of access story an assessor and a program security officer can both accept.

Secure Resolve and Secure Access — endpoint and browsing risk in the compliance story

Secure Resolve blocks phishing, malware, and malicious domains at the endpoint. Secure Access (Anti-Venom Secure Access) surfaces browser extensions, Shadow AI, risky SaaS, and exfiltration-oriented browsing — including signals that matter for CUI and export-sensitive environments.

Endpoint and browser risk are not “IT hygiene side quests.” They are control evidence.

ASPIRE™ and MAVICE℠ — executive truth with drill-down

ASPIRE™ answers technical posture. MAVICE℠ answers maturity. Together they support the questions authorizing officials, CISOs, and boards actually ask:

• Are we audit-ready against our contracted frameworks today?

• Which controls fail, and what evidence proves it?

• What are the top remediations that move CMMC / NIST posture this sprint?

• Can we show continuous improvement to an AO, 3PAO, prime, or board?

Vendor scores without evidence are theater. Scores with drill-down to readable proof are a management system.

Readable evidence doctrine

Assessors and analysts should not be asked to decode raw JSON as the primary story. XISEM presents human-readable, complete evidence — labeled fields, structured detail, full pertinent facts. Raw JSON remains available as an audit appendix, not the default narrative.

That doctrine matters when a C3PAO or agency reviewer opens the console. They get evidence chains and binders — not an opaque vendor dashboard as the only artifact.

Siloed mission tenancy

Client and agency data stays siloed. Attribution is enforced at write time. Managed service provider rollups must not bleed one mission’s identities, events, or assets into another. Isolation is not a UI filter; it is a platform rule.

FedRAMP journey surfaces — honest by design

XISEM GOV includes accreditation-status tracking and compliance POA&M surfaces for executive reporting between 3PAO milestones. That is operational support for a FedRAMP-oriented journey.

It is not a claim that Dual-Strike is FedRAMP authorized unless that status is separately attained and published. We support FedRAMP-oriented operations and evidence. Authorization status is separate — and we will not pretend otherwise.

ITAR-supporting controls — not a legal determination engine

For export-controlled programs, XISEM GOV supports the program security story: identity hygiene, least privilege, endpoint controls, and browsing / exfiltration-oriented signals with defensible audit evidence.

Legal ITAR determinations stay with counsel and the Empowered Official. The platform supports the controls; it does not replace the legal determination.

Designed for operators, not alert theater

A Cyber Operations Platform does three jobs well:

1. Discover the mission footprint — assets, identities, SaaS, endpoints

2. Secure with Elevate / Resolve / Access — least privilege and endpoint / browsing risk

3. Prove with daily evidence, POA&M, binders, and ASPIRE / MAVICE trajectory

Logs are inputs. Evidence is the product. Action is the outcome.

That is why XISEM GOV fits agencies, DIB primes and subcontractors, state and local programs under GovRAMP / StateRAMP / TX-RAMP pressure, and government-focused MSPs who cannot afford another console that only pages people.

What we do not claim

Public-sector buyers deserve precision:

• We do not claim FedRAMP authorization Dual-Strike has not officially attained.

• We do not issue ITAR licenses or legal determinations.

• We do not replace agency SOC-as-a-service mandates or official PMO / ATO packages.

• We do not position XISEM as “instead of” your EDR, identity provider, or GRC system — we extend and operationalize evidence those systems produce.

Who this is for

• CISOs, ISSOs, and compliance managers who live under NIST / CMMC calendars

• Authorizing officials, CIOs, and program executives who need trajectory, not theater

• Defense Industrial Base primes and subcontractors protecting CUI

• State and local programs under GovRAMP / StateRAMP / TX-RAMP expectations

• C3PAOs, systems integrators, and government MSPs / MSSPs who need readable evidence packages

Next step

If your program can pass an assessment week but cannot prove readiness on an ordinary Tuesday, start here:

dual-strike.com/solutions/government · Contact government sales · Request a demo

Audit-ready today. Every day.

— The Dual-Strike team

Most MSPs, MSSPs, and vCISO practices still walk into a first meeting with a slide deck and a promise. The USB Prospecting Tool lets you walk in with evidence.

It is a self-contained Windows assessment application — no .NET install on the prospect PC, no agent deployment, no policy enforcement. Run a LAN discovery scan on site, export a leave-behind summary, upload results into the Prospecting Center, and generate a branded HTML report before anyone signs a contract.

Who it is for: MSP and MSSP sales teams, field technicians, and vCISOs doing on-site or air-gapped prospect visits. Direct commercial clients with an MSP partner use the same pipeline when their provider runs assessments.

Get started: Sign in at dual-strike.com, open Tenants and Prospects → Prospects, and download the Prospect Scanner USB Win64 package from the MSP download card. This tool is partner-only — it is not on the public agent downloads page.

Why this is a game changer for MSPs, MSSPs, and MIPs

Assessment before the contract. You do not need prospect IT to install software, open firewall ports, or provision a tenant before you can show value. One permitted run on a workstation gives you a network map, host inventory from discovery, open ports, and remote-access signals — enough to anchor a credible first conversation.

One platform from prospect to client. USB scans land in the same Dual-Strike XISEM console as production agents. When the deal closes, you are not migrating tools — you are extending coverage. Full posture sections — Active Directory, patching, security tools, browser posture — unlock after XISEM Agent enrollment on managed endpoints.

Pipeline built in, not bolted on. The Prospecting Center tracks stages from Identification through Result, pipeline value, next actions, and prospect types including One-Off, MSP, MSSP, and Trial. Inbound leads from marketing pages and SuperOps trial imports feed the same funnel.

Free assessment edition. Unlike stacks that charge for discovery appliances or per-seat assessment SKUs, the USB Prospecting Tool ships with XISEM partner releases at no separate assessment license. Your cost is technician time — not another product line item.

What the USB Prospecting Tool does

LAN discovery scan

The scanner runs native on-network discovery: ICMP reachability, ARP cache, reverse DNS, TCP port checks, and OS hints. Results use the same contract as XISEM Agent NetRecon, so findings correlate cleanly when you enroll agents later.

Typical first-meeting outputs include:

• Remote hosts — IP, hostname, MAC where available

• Open ports and inferred services

• Weak OS fingerprint guesses

• RMM and remote-access tools inferred from open ports

• Local JSON and HTML archives beside the executable for leave-behind

Three ways to link a scan to your pipeline

Choose the mode that fits the visit:

1. New prospect — enter company name; the platform creates the prospect record on first upload.

2. Link code — enter the eight-digit code from the prospect detail dialog in the console. Codes expire after thirty days.

3. Signed in — authenticate with your Dual-Strike credentials and pick from your active prospect list.

Multi-PC and multi-subnet site visits

Large sites rarely fit on one machine. Copy the tool to an encrypted USB drive. The first PC creates or links the prospect. Each additional PC appends scan sections to the same prospect record. Unique scan IDs keep every run traceable.

Scan offline if needed. Upload when you have connectivity and a configured infeed token.

Headless automation

For scripted field kits, run XISEM.ProspectingScanner.App.exe --nogui "Company Name" to scan and upload without the graphical interface.

Override scan targets with the XISEM_SCAN_TARGET environment variable when you need a specific CIDR or IP list.

Prospecting Center: reporting and sales workflow

After upload, open the prospect in Tenants and Prospects → Prospects.

Sales pipeline

Track six stages — Identification, Initial Meeting, Assessment, Quotation, Proposal, and Result — with status, estimated value, close dates, and upcoming actions. The funnel chart shows where active deals sit at a glance.

Scan Data and HTML reports

The Scan Data tab shows structured sections from every upload. Click Generate Report for a downloadable HTML assessment.

USB-only runs are labeled LAN Discovery Assessment. Sections that require agent enrollment — AD, host inventory, patching, security tools — are marked Available after enrollment, which sets honest expectations and creates a natural upsell path.

Reports are print-friendly: clean typography, metric cards, and finding callouts designed for executive readouts and PDF export from the browser.

Integrations that close the loop

Link prospects to SuperOps accounts, Hudu companies, and trial IDs. Hudu sync modes — automatic, manual, or conversion-only — keep documentation aligned with your PSA workflow.

Import SuperOps trial orgs directly into the pipeline with Import Trials.

Anti-Venom Monitor: 14-day trial inside Prospecting

Starting with Prospecting workflows, partners can offer prospects a 14-day Dual-Strike XISEM platform trial that includes Anti-Venom Secure Access in Monitor mode.

Monitor mode is observe-only. It runs full indicator lookups and provider feed validation without watermarks or blocking. Your prospect sees real browsing telemetry — SaaS usage, AI tool sessions, MFA app patterns — while you build the case for Protect mode after contract signature.

Recommended prospect journey:

1. Day zero — USB LAN discovery at the first meeting. Leave behind local HTML summary.

2. Day one — Upload to Prospecting Center. Generate branded LAN Discovery report for IT leadership.

3. Days one through fourteen — Deploy XISEM Agent to a pilot group. Enable Anti-Venom Monitor on Chrome, Edge, Firefox, or Safari. Review Browsing Insights with the prospect.

4. Day fourteen — Walk through ASPIRE posture, Threat Center context, and a scoped proposal. Convert prospect to client.

The platform trial supports up to five client tenants with no credit card required. Pair it with the USB assessment for a complete pre-contract story: network truth on day zero, browser truth by day seven.

What it does not do

Be direct with prospects:

• The USB tool does not replace production XISEM Agent deployment.

• It does not send data without your configured upload and explicit action.

• It does not enforce policies, block users, or install persistent services — assessment only.

• Full posture sections require agent enrollment after conversion.

That honesty is a feature. Prospects trust read-only snapshots. Production monitoring uses the same evidence doctrine with continuous correlation in Dual-Strike XISEM.

Field workflow checklist

1. Download the USB package from Prospecting Center. Extract to an encrypted USB drive.

2. Optionally place prospect_scanner.settings.json beside the executable with your infeed token.

3. Run on a prospect workstation with written permission.

4. Review findings with the IT lead on site.

5. Upload to XISEM. Open Scan Data and generate the HTML report.

6. Start the 14-day trial with Anti-Venom Monitor on pilot endpoints.

7. On signature: convert prospect, deploy fleet agents, and advance Monitor to Protect when ready.

Talk track

> "This is a read-only LAN discovery snapshot — no agents installed, no blocking, no data leaving your network until you approve upload. If we partner, the same platform carries from this assessment through managed monitoring, browser security, and compliance reporting. We can even run Anti-Venom in Monitor mode for two weeks so you see real browsing telemetry before anything is enforced."

Related reading: MSP first 7 days quickstart · ASPIRE scoring · Evidence doctrine infographic

Next step: dual-strike.com · Partner program at /get-xisem/msp · Request a demo

Illustrations use anonymized demo data. USB Prospecting Tool version aligns with current XISEM GA releases — check the Prospecting Center download card for build number and SHA-256.

Roaming DNS is still the quiet gap in endpoint security.

Users leave the office. VPN split-tunnel fights the roaming client. Windows 11 enables encrypted DNS in Settings. Browsers send queries around the OS resolver. The SIEM gets a vendor export from last month — not proof that a block happened on this laptop, for this user, now.

Anti-Venom Secure Access already covers the browser: session telemetry, verdict watermarks, AI-tool visibility, and policy in Chrome, Edge, and Firefox — correlated in Browsing Insights and investigations.

Today we name the network half:

Anti-Venom Secure Resolve

Dual-Strike XISEM’s first-party endpoint DNS protection — a lightweight bolt-on that works with Secure Access, not instead of it.

LayerProductWhat it protects BrowserAnti-Venom Secure AccessTabs, sessions, phishing paths, SaaS and AI-tool policy Network / resolverAnti-Venom Secure ResolveOS and app DNS before traffic leaves the endpoint

Same Anti-Venom family. Different surface. One correlated picture in the console.

Why two products?

No single hook sees every query.

• Secure Access — inside the browser, including DoH bypass paths and session-level policy

• Secure Resolve — at the system resolver: apps, scripts, and background agents that never open a tab

Together they cover home ISP routers, split-tunnel VPN, Win10/Win11 encrypted DNS, and non-browser software that still phones home over DNS. Neither replaces your EDR. Both feed Dual-Strike XISEM’s evidence doctrine — neutral facts in, correlated posture and investigations out.

What Secure Resolve does

Paired with the Dual-Strike XISEM Agent on Windows 10 and 11:

• Local-first policy — lists cached on the endpoint; cloud for sync and evidence

• VPN- and NRPT-aware — internal zones stay on VPN DNS; yields to known relays instead of fighting them

• Encrypted upstream — aligned with modern Windows DoH/DoT

• Evidence in the same pane — batched query and block events for ASPIRE, COBRA², and investigations

• MSP policy packs — one baseline, per-client exceptions, approve/deny without a second vendor console

• Learning mode first — log would-block before enforce, like Secure Access

Defense in depth: Resolve blocks C2 and unwanted categories at the resolver. Secure Access enforces browser policy on what users actually visit. When browser DoH bypasses OS DNS, Secure Access still sees it. When malware resolves a domain outside the browser, Secure Resolve still sees it.

Your DNS, your choice

Already on DNSFilter or another DNS infeed? Keep it. Third-party DNS stays in the open integration fabric — evidence in, correlation out. Secure Resolve is the first-party bolt-on for MSPs who want policy and unblock workflow inside Dual-Strike XISEM. Run either, or both while you migrate.

Who it is for

MSPs standardizing browser and resolver policy on one console. vCISO teams tired of “DNS active” posture with no per-endpoint proof. Distributed shops where legacy roaming clients break on VPN and Win11. Existing Secure Access customers adding resolver coverage without a second product story.

Availability

Anti-Venom Secure Resolve ships on the Dual-Strike XISEM Agent 8.8+ line as a bolt-on SKU — same release train as the Windows agent and Edge Scan Sensor.

PhaseWhat NowProduct naming and MSP preview enrollment NextWindows resolver preview — audit mode and DNS evidence in investigations GAEnforce mode, unified block/unblock with existing DNS infeeds, in-console policy packs

Early access: Reply here or reach us via dual-strike.com — share your Secure Access footprint, VPN mix, and any third-party DNS infeed.

Already on Secure Access? No browser redeploy required. Resolve adds the resolver layer when you are ready.

Downloads (agent + extension today): dual-strike.com/downloads

> Secure Access protects the browser. Secure Resolve protects the resolver. Dual-Strike XISEM connects both to identity, device, and investigation — so DNS is evidence, not a checkbox.

Anti-Venom Secure Access and Anti-Venom Secure Resolve are components of Dual-Strike XISEM. Third-party DNS integrations remain optional. Confirm current GA status on dual-strike.com before customer commitments.

If you run an MSP, you already bought the stack. PSA. RMM. EDR. Identity. DNS. Browser controls. You don't need another vendor telling you to rip and replace.

You need a Cyber Operations Platform that makes what you already run more valuable — correlated, reportable, and actionable for technicians and executives alike.

That's what the Strategic Technology Alliance Program (STAP) is for.

STAP is not an integrations program. It's a technology alliance framework: mutual value between Vysion Technology Solutions, alliance partners, MSPs, MSSPs, MIPs, and shared customers.

What STAP means for your operation

Dual-Strike XISEM extends, enriches, operationalizes, and orchestrates existing technology investments. Every alliance partner should feel that XISEM improves adoption, visibility, executive reporting, operational intelligence, and customer outcomes for their platform.

Three concepts to remember:

1. Cyber Operations Platform — XISEM is the layer above your tools, not a substitute for them.

2. Shared Security Context — telemetry from every alliance enriches every other source continuously.

3. Operational Intelligence — correlated events become decisions your team can act on Monday morning.

Shared Security Context

Products don't operate in silos. Telemetry from Microsoft, EDR, identity, DNS, browsers, Scout, and alliance gateways flows into one shared context — then becomes Operational Intelligence.

```mermaid

flowchart TB

MS[Microsoft]

S1[SentinelOne]

TL[ThreatLocker]

GZ[Guardz]

PT[Petra]

DNS[DNS]

BR[Browsers]

ID[Identity]

SC[Scout]

SN[Sonar]

CB[COBRA²]

SSC[Shared Security Context]

OI[Operational Intelligence]

MS --> SSC

S1 --> SSC

TL --> SSC

GZ --> SSC

PT --> SSC

DNS --> SSC

BR --> SSC

ID --> SSC

SC --> SSC

SN --> SSC

CB --> SSC

SSC --> OI

```

Messaging: do this, not that

AvoidPrefer XISEM replaces SentinelOneXISEM operationalizes SentinelOne telemetry XISEM replaces ThreatLockerXISEM extends ThreatLocker policy intelligence through Shared Security Context XISEM replaces HuntressXISEM enriches Huntress detections with browser, identity, DNS, compliance, and organizational context XISEM integrates with GuardzXISEM operationalizes Guardz intelligence through graph correlation and executive reporting

Never state or imply: replace · compete with · alternative to · instead of

Preferred language: extends · enriches · correlates · operationalizes · orchestrates · amplifies · unifies · enhances

Launch Packs (curated onboarding)

STAP onboarding is organized into Launch Packs — not one-off vendor checkboxes:

Launch PackAlliances MSP EssentialsXISEM, SuperOps, Microsoft 365, Anti-Venom Identity ProtectionXISEM, Petra, Keeper Business ProtectionXISEM, Guardz, Anti-Venom Endpoint SecurityXISEM, SentinelOne, ThreatLocker, Huntress ComplianceXISEM, Petra, ASPIRE, MAVICE, CAA

Select a Launch Pack in Partner Center → New Prospect when standing up a new evaluation.

Priority alliances (where we're investing first)

Priority 1: SuperOps · Petra · Guardz

Priority 2: SentinelOne · ThreatLocker · Huntress · Keeper · Proofpoint · DNSFilter

Each alliance in Partner Center shows status, gateway availability, Launch Pack placement, evaluation support, and documentation links.

What you can do today

• Explore alliances: dual-strike.com/partners

• Program overview: dual-strike.com/support/stap-strategic-technology-alliance-program

• MSP partners: apply through Partner Center for Launch Packs, evaluations, and federation

We won't ask you to abandon the vendors your clients already trust. We will help you operationalize them — together — through Shared Security Context.

— The Dual-Strike team

K-12 cybersecurity has a visibility problem dressed up as a tooling problem.

Most districts already own an endpoint product, a filter, and a Microsoft 365 or Google Workspace tenancy. What they rarely own is a single, honest answer to the questions a superintendent and a school board actually ask:

1. Are we more secure than last month?

2. Which schools or campuses are at greatest risk?

3. What are the top five actions that will improve our posture?

4. Can we prove improvement for grants, insurers, and state reporting?

Those are not SIEM questions. They are operations questions. Dual-Strike XISEM for Education (XISEM EDU) is built for that reality: a cyber operations platform for districts that do not have a twenty-person security operations center — and should not need one to run a defensible program.

> One platform to discover, secure, measure, and prove continuous improvement across every student, staff member, classroom, and campus.

Explore: dual-strike.com/solutions/education

The district problem in plain language

Schools face ransomware, credential theft, and data exposure with staffing that would be called “under-resourced” in any private enterprise. Point tools create alert noise. Boards and grantors ask for measurable improvement, not another dashboard login.

The failure mode is familiar:

• Inventory lives in three places and none of them know about the smart board, the lab printer, or the Chromebook that never joined the right OU.

• Teachers still have standing local admin “because the projector driver broke last semester.”

• Filtering works on campus and softens once students and staff leave the network.

• Compliance evidence is assembled in January for a binder that is stale by March.

• When something happens, the story is scattered across logs, tickets, and screenshots — not a readable timeline a small team can act on.

XISEM EDU does not ask districts to throw away what already works. It correlates identity, assets, browsing, endpoint controls, and compliance evidence into one posture story those tools cannot tell alone.

Built for the Enhancing K-12 Cybersecurity Act agenda

The bipartisan Enhancing K-12 Cybersecurity Act (reintroduced 2023) points CISA toward three outcomes for primary and secondary schools:

1. Information, best practices, and training through a cybersecurity information exchange

2. Incident visibility through voluntary K-12 cyber incident tracking

3. Technology improvement — helping schools deploy cybersecurity capabilities against real risks to school information systems

XISEM EDU is not a substitute for CISA programs or mandated reporting. It is the district operating layer that turns that agenda into daily posture, measurable improvement, and audit-ready proof.

What the Act pushes towardHow XISEM EDU meets itHow XISEM EDU goes further Information, best practices & trainingCISA-aligned guidance in live compliance dashboards — not a static PDF toolkitLive top-five actions and campus risk ranking every day Incident tracking & threat landscapeEvidence-driven detections, alerts, and readable investigation timelinesOptional Community Gateway — anonymized ESC/SEA trends without student PII Deploy cybersecurity capabilitiesScout agents, Secure Elevate / Resolve / Access, Microsoft 365 + Google Workspace + Active Directory identityAutomated grant evidence — before/after posture and control proof packs

Meet the Act. Exceed the toolkit.

What a superintendent actually needs

Complete campus discovery

Security programs fail when they only know about the Windows laptop that enrolled cleanly. XISEM EDU discovers across the real campus footprint: Windows, macOS, Chromebooks (where supported), Linux, mobile, network gear, printers, IoT, cameras, smart boards, and lab equipment.

You cannot protect what you cannot see — and you cannot rank campus risk without a complete inventory.

Identity for schools

Districts run hybrid identity worlds. XISEM EDU correlates Microsoft 365, Google Workspace, and Active Directory / LDAP so dormant accounts, privilege creep, and impossible travel / geo-velocity show up as identity posture — with staff versus student context where the environment supports it.

Identity is not a separate product silo. It is part of the same story as the device and the browsing session.

Secure Elevate — end standing admin for teachers and IT

Standing local administrator rights are still one of the most common ways a phishing click becomes a district-wide incident. Secure Elevate eliminates permanent teacher and IT admin rights and replaces them with just-in-time elevation with evidence — so helpdesk workflows still work, and auditors can see who elevated, when, and why.

Secure Resolve — protection that travels

Students and staff leave campus. Threats do not respect the firewall. Secure Resolve blocks phishing, malware, and inappropriate domains at the endpoint — on campus or at home — so filtering posture is not a building-hours feature.

Secure Access — Shadow AI, risky SaaS, and browser risk

Classroom and staff browsing is where Shadow AI tools, risky SaaS, and exfiltration-oriented behavior show up first. Secure Access (Anti-Venom Secure Access) monitors browser extensions, Shadow AI usage, risky SaaS, and data-exfiltration oriented browsing signals — so IT can teach, policy, and remediate with facts instead of rumor.

Compliance without the binder chase

Grantors, insurers, and state programs ask for alignment to CIS Controls, NIST Cybersecurity Framework, and CISA K-12 guidance. XISEM EDU maps live evidence into compliance dashboards, daily control refresh, plans of action and milestones (POA&M), and grant-ready packs — so “prove improvement” is not a weekend of screenshots.

ASPIRE™ and MAVICE℠ — scores that answer human questions

ASPIRE™ is technical posture truth. MAVICE℠ is maturity. Together they answer board-level questions without translating ten thousand alerts:

• Are we more secure than last month?

• Which campuses are at risk?

• What are the top five actions?

Scores without drill-down are vanity. XISEM EDU ties letter grades and trends back to evidence a small team can act on.

Community Gateway (optional) — share trends, not student data

Educational Service Centers and State Education Agencies need regional awareness without becoming a privacy liability. The optional Community Gateway supports anonymized, aggregated rollups for ransomware, phishing, and vulnerable-technology trends — without exposing student personally identifiable information in shared telemetry.

Districts stay siloed. Shared views stay privacy-first and FERPA-aware by design.

Designed for thin IT teams

XISEM EDU is intentionally not another alert factory.

A district with two or three technology staff members cannot live inside a log warehouse. They need:

• Discovery that covers classroom reality

• Controls that fit helpdesk workflows (Elevate / Resolve / Access)

• Measurement a superintendent can understand

• Evidence that survives a grant review or insurance questionnaire

That is the difference between a cyber operations platform and a pile of point products that never become a program.

What we do not claim

Honesty matters in public sector sales:

• XISEM EDU does not replace CISA, MS-ISAC, or mandated incident reporting to federal or state agencies.

• It does not claim to be a complete legal FERPA determination engine — it supports a privacy-aware operating posture (siloed tenants, minimized student data in shared views, anonymized community trends).

• It does not ask you to rip out your EDR or web filter. Keep them. XISEM correlates what they cannot see alone.

Who this is for

• District CIOs and Directors of Technology

• Superintendents and board cyber committees who need measurable improvement

• Educational Service Centers and State Education Agency cybersecurity coordinators

• Education-focused MSPs and MSSPs supporting multi-district portfolios

Next step

If your district is drowning in tools and still cannot answer “are we better than last month,” start here:

dual-strike.com/solutions/education · Contact education sales · Request a demo

Secure the classroom. Prove the posture.

— The Dual-Strike team

Remote offices, warehouse VLANs, clinic branches, and ISP-router flat networks share one problem: no always-on workstation.

Traditional RMM discovery assumes a managed PC stays online. Traverse-style site scanners assume you will ship an appliance subscription. Dual-Strike XISEM solves the gap with the Edge Scan Sensor — a headless Linux collector built for Raspberry Pi and other arm64 boxes that lives on the customer LAN and phones home to your console.

Who it is for: MSPs and MSSPs shipping plug-and-play sensors to client sites. Direct commercial clients with multi-site footprints. Any practice that needs nominated site scans and network inventory where a full desktop agent is impractical.

Why partners call it a game changer: Commodity hardware, a free public installer, per-asset platform pricing, and the same correlation engine as your Windows fleet — without a second NMS bill or a workstation burning power overnight.

Lowest total cost of ownership in the edge sensor category

We are comfortable saying this plainly: the Edge Scan Sensor is among the lowest-cost edge discovery options you can deploy today.

Here is the math most MSPs run:

Cost lineEdge Scan SensorTypical alternatives HardwareBring your own Raspberry Pi Zero 2 W, Pi 3, Pi 4, or Pi 5 — often thirty-five to seventy-five dollarsProprietary appliance — hundreds to thousands Software installFree public arm64 installer from dual-strike.comAppliance license or per-site scanner SKU Power drawRoughly three to five watts — pennies per monthFull desktop or NMS appliance — tens of watts Platform billingPer managed asset on Dual-Strike XISEM — servers, IoT, and infrastructure count transparentlyPer-user RMM pricing hides infrastructure

You are not buying a locked appliance. You are enrolling a first-class infrastructure asset on the same platform that runs your agents, browser security, and compliance mapping.

Public installer one-liner: run the latest arm64 installer from dual-strike.com/downloads — search for XISEM EdgeSensor Linux arm64, or use the curl command shown in Infrastructure → Edge Sensors when you mint a ZeroConfig pack.

MSP partners also use Edge Sensor Prep — a Windows USB writer that stages ZeroConfig bundles before a Pi ships. Download from MSP downloads in the console or Infrastructure.

What the Edge Scan Sensor does

On-LAN discovery

The sensor runs native LanDiscoveryEngine sweeps from inside the customer network:

• ICMP reachability

• ARP and neighbor tables for MAC quality on Linux

• Reverse DNS

• TCP banner checks

• SNMP for switches, routers, printers, NAS, VoIP, cameras, and IoT

Discovered devices flow through ingest-network-discovery into your asset inventory and topology views — correlated with agents, identity, and EDR evidence on the platform.

Always-on when workstations sleep

Workstations go home at five p.m. The Pi does not. Default forty-five-minute LAN sweep cadence keeps inventory fresh on nights and weekends — the overnight visibility badge you will see in Infrastructure when minting a ZeroConfig pack.

Site scan nominations

Nominate the sensor in Infrastructure → Site Scan Settings the same way you nominate a workstation scanner. Policy arrives via get-agent-scan-policy. Heartbeats confirm the sensor is alive.

Registered infrastructure asset

The sensor is not a shadow process. It provisions as device_class=infrastructure with asset_role=edge_scan_sensor — visible in inventory, health dashboards, and compliance scope.

Agentless SNMP path

SNMP polling from the on-net collector is on the active roadmap for full parity with workstation agentless collectors. MSPs deploying today get LAN discovery and periodic sweeps; SNMP depth expands without replacing hardware.

Four provisioning modes — ship how you sell

ModeBest forWhat happens MSP pre-configKnown client before shipZeroConfig bundle with infeed token on USB Identity enrollLabel with company and emailAuto-provision on first boot Phone homeBlank ship to stockMSP claims in Unclaimed Agents and assigns tenant Site labelMulti-site MSPsite_label maps to client site on every payload

Hardware identity — serial, model — is read from Linux device tree for matching and audit.

MSP deployment workflow

Step one — Mint ZeroConfig in the console

Open Infrastructure → Edge Sensors. Select client and site. Generate a ZeroConfig pack with credentials, installer URL, and ship checklist.

Step two — Stage USB with Edge Sensor Prep

Import the bundle JSON into XISEM Edge Sensor Prep on Windows. Write xisem-edge-sensor/ to USB — config, environment, and README for the bench tech.

Step three — Flash and ship the Pi

Flash Raspberry Pi OS Lite 64-bit with Raspberry Pi Imager. Copy the flash kit boot overlay or USB staging folder. First-boot script expands the filesystem, applies MSP overlay, runs the installer, and reboots clean.

Supported boards: Pi Zero 2 W, Pi 3, Pi 4, Pi 5, and generic arm64 or x64 headless Linux.

Step four — Nominate and verify

In Site Scan Settings, nominate the sensor for LAN scans. Within one harvest cycle, confirm assets appear in Infrastructure and topology views.

Console routes: /infrastructure?tab=edge-sensors · /infrastructure?tab=site-scans · /admin/unclaimed-agents

Benefits for MSPs, MSSPs, and direct clients

Close the remote-office discovery gap. Branches without a server or always-on PC finally appear on your map — the same gap legacy Traverse-style scanners addressed, without a proprietary box.

ISP-router and flat LANs. Discovery runs on-net. No dependency on cloud-only scanning that cannot see private RFC1918 space.

One correlated story. Edge discoveries sit beside XISEM Agent posture, Anti-Venom browsing telemetry, M365 sign-ins, and EDR detections in the Asset modal — not a siloed NMS export.

Transparent economics. Per-asset pricing means a Pi sensor and a printer both count clearly. No hidden per-user tax on infrastructure.

Scale with your fleet. Ship ten Pis to ten sites for less than one enterprise appliance line item. Spares are a thirty-dollar board, not a return merchandise authorization.

Direct client fit. Commercial IT teams with warehouses, clinics, or franchise locations get site visibility without leaving a desktop online or buying a second platform.

Edge Scan Sensor vs USB Prospecting Tool

USB Prospecting ToolEdge Scan Sensor PurposePre-contract assessmentPersistent enrolled asset HardwareTechnician laptop or USB stickRaspberry Pi on-site DurationPoint-in-time visitContinuous sweeps InstallNo agent — read-only scanHeadless service, no tray Best momentFirst sales meetingAfter client signs

Use both: USB Prospecting wins the deal. Edge Sensor keeps the branch visible after onboarding.

Honest limitations

• SNMP and SSH agentless depth on the sensor is still expanding — LAN discovery and periodic sweeps are production-ready; full agentless parity is on the roadmap.

• Flash kit ships as boot overlay plus installer — not a single pre-baked image file. MSPs use Pi Imager plus Edge Sensor Prep for repeatable ship kits.

• Cloud-only SaaS workloads appear through identity and browser signals, not L2 maps — pair edge discovery with Anti-Venom and M365 infeeds.

Talk track

> "We drop a forty-dollar Raspberry Pi on your branch network. It discovers printers, switches, IoT, and rogue hosts overnight — and feeds the same Dual-Strike console as your desktops. No appliance subscription. No PC left running. When you are ready, we nominate it for site scans and you see the branch on the same map as headquarters."

Related reading: Network topology discovery · USB Prospecting Tool · Evidence doctrine

Next step: dual-strike.com · Infrastructure → Edge Sensors · MSP partner program

Edge Scan Sensor aligns with current XISEM GA releases. Illustrations are representative — anonymized demo topology.

Standing local administrator rights are one of the most common ways a phishing click becomes a fleet-wide incident.

Helpdesks grant them because installers break without them. IT keeps them because maintenance windows are unpredictable. Auditors flag them every assessment cycle — and they come back anyway because "temporary" became culture.

Classic elevation tools optimize for allowing approved apps. They often stop there: a vendor silo, a tray icon, a log export nobody correlates with identity risk, browsing sessions, or compliance posture.

Anti-Venom Secure Elevate takes a different goal: eliminate standing admin — and make every elevation a first-class security event on the same XISEM graph as alerts, investigations, ASPIRE, and compliance.

Privilege on demand. Zero standing admin. Every grant evidence-backed.

Explore: dual-strike.com/antivenom/elevate · dual-strike.com/antivenom · dual-strike.com

The standing-admin problem in plain language

Local administrator membership is a blunt instrument. It solves today's installer pain and creates tomorrow's lateral movement path.

The failure mode is familiar across MSP portfolios and enterprise fleets:

• Teachers, engineers, or finance staff retain admin "because the projector driver broke last semester."

• IT accounts carry standing privilege long after the project that required it ended.

• Elevation happens outside any system the SOC monitors — then expires without proof the fleet returned to least privilege.

• Assessors ask who elevated, when, and why — and the answer is a ticket comment, not a correlated evidence chain.

Secure Elevate does not replace Active Directory, Intune, or your RMM. XISEM extends and operationalizes endpoint privilege — the same STAP posture we take across the stack: enrich what you already run, correlate it, make it actionable.

How Secure Elevate works

Secure Elevate is just-in-time local privilege with full audit into Dual-Strike XISEM — delivered through Scout, the Dual-Strike XISEM endpoint agent.

• Eliminate standing local admin — Deploy Elevate, remove standing membership, and let JIT carry installers and admin tasks.

• Tray request or policy auto-match — Users request elevation from the Scout tray — or policy matches process, publisher, hash, or path automatically.

• MIP / Lookout / PSA approval — Approve in the privileged console, the Lookout technician companion, or an urgent PSA ticket with Slack / Teams fan-out.

• Timed grant, automatic revoke — Scout adds timed Administrators membership (or platform equivalent), then tears it down when the window expires.

• Privilege as a security event — Request → approve → grant → expire → revoke lands as XISEM alerts and audit evidence — not a vendor silo.

• Re-harvest proof — Local admin inventory harvest proves the fleet returned to least privilege after every elevation window.

• Realtime operator awareness — Bell, Slack / Teams, and Lookout paths so approvals do not die in an inbox nobody watches.

• Scored with ASPIRE & CAA — Elevation context sits next to client posture and Continuous Access Attestation — not isolated ringfencing.

Users are not standing admins. When they need privilege, Scout grants a timed membership, then revokes. Measurable goal: 0% standing admin with re-harvest proof, not a policy PDF.

Least privilege without killing productivity

Security teams and helpdesks share the same constraint: block standing admin without blocking the business.

Secure Elevate supports three approval paths so elevation fits how you already operate:

• Privileged Identity console (MIP) — Security and identity teams review and approve with full context.

• Lookout — Technicians get mobile-aware notifications for urgent elevation requests.

• PSA integration — Urgent tickets with Slack / Teams fan-out when inbox-only approval is too slow.

Policy auto-match reduces friction for known-good scenarios — signed installers, approved publishers, hash- or path-bound maintenance tasks — while keeping human gates for high-risk or novel requests.

Timed grants mean privilege is borrowed, not owned. Automatic revoke means the default state returns to least privilege without a cleanup script someone forgets to run.

Elevation that logs into the SOC's plane

Elevation products that do not land in your security operations timeline are just another island.

Secure Elevate optimizes for a different outcome: every elevation visible alongside phishing sessions, DNS blocks, browsing policy hits, identity posture, and compliance mappings — because it is native to Dual-Strike XISEM, not bolted on afterward.

That matters when:

• An analyst investigates lateral movement and needs to know whether standing admin existed on the asset during the incident window.

• A vCISO reports least-privilege posture to a board and needs proof, not aspiration.

• An assessor asks for privileged-access evidence and expects timestamps, approvers, and revocation — not screenshots.

Coexist with inventory-class elevation tools if you keep them today. Or replace the island with Scout-native JIT when you are ready. XISEM does not demand rip-and-replace on day one.

The Anti-Venom family — Elevate is one surface

Anti-Venom protects where users and endpoints actually interact with risk. Secure Elevate handles local privilege. Sibling products cover adjacent attack paths:

• Anti-Venom Secure Access — Browser enforcement: session telemetry, SaaS attribution, Shadow AI visibility, policy in Chrome, Edge, Firefox, and Safari. dual-strike.com/antivenom/access

• Anti-Venom Secure Resolve — Endpoint DNS protection at the system resolver — apps and malware that never open a tab still hit policy. Pairs with Secure Access for browser DoH coverage. dual-strike.com/antivenom/resolve

• Anti-Venom Secure Control — Vendor-agnostic desired-state policy and configuration assurance — detect drift, govern exceptions, map evidence into ASPIRE and compliance. dual-strike.com/antivenom/control

• Anti-Venom Secure Elevate — Just-in-time local admin with full XISEM audit. dual-strike.com/antivenom/elevate

Elevate removes standing privilege on the endpoint. Secure Access governs the browse path. Secure Resolve governs resolver traffic. Secure Control proves configuration stayed where you set it. Together they close the gap between policy intent and observable posture.

For cloud OAuth and cross-tenant trust — a different lens — see XISEM Visa: dual-strike.com/visa

What we do not claim

Public buyers deserve precision:

• Secure Elevate does not replace Microsoft Entra Privileged Identity Management or cloud admin JIT — it targets local standing privilege on managed endpoints via Scout.

• Secure Elevate does not remove the need for helpdesk process — it adds evidence, timed grants, and approval paths helpdesks can defend.

• Secure Elevate does not guarantee zero incidents — it eliminates a recurring finding and a recurring lateral-movement enabler with measurable re-harvest proof.

• Secure Elevate does not require you to uninstall other elevation vendors on day one — coexistence is supported; consolidation is a program decision.

Who this is for

• MSPs standardizing least privilege across client fleets without breaking installer workflows

• K-12 and higher-ed IT teams eliminating standing teacher and lab admin

• Government and defense-industrial programs where assessors expect JIT privilege with evidence chains

• vCISO and compliance leads tying local admin posture to ASPIRE, CAA, and framework mappings

Next step

If standing local admin is still your default — and your SOC cannot prove otherwise — start here:

dual-strike.com/antivenom/elevate · dual-strike.com/antivenom · Deploy Scout · Request a demo

Privilege on demand. Zero standing admin.

— The Dual-Strike team

Microsoft 365 and Google Workspace are where your business actually runs — and where attackers actually land.

Not in a SIEM log from last Tuesday. In the tenant itself: a forwarding rule on an executive mailbox, a Drive folder shared with anyone-with-link, a global admin without phishing-resistant MFA, a super admin role that has been active for ninety days without a review.

Point tools and native admin consoles hold pieces of that truth. What most teams lack is a single posture program — deduplicated findings, drift since baseline, readable evidence, and a path from discovery to remediation without another dashboard island.

Dual-Strike XISEM SSPM (SaaS Security Posture Management) watches the tenant end to end: identity hygiene, mail flow, sharing exposure, admin sprawl, and policy drift. Read-only by default. Bound to ASPIRE, COBRA², and 100+ compliance frameworks the moment findings land.

Your SaaS, defended at the tenant — not a spreadsheet you refresh before the audit.

Explore: dual-strike.com/sspm · dual-strike.com

The tenant problem in plain language

SaaS security failures rarely announce themselves as "SaaS incidents." They show up as:

• External mail forwarding that exfiltrates before anyone notices the transport rule.

• Anyone-with-link sharing on folders that contain finance, HR, or engineering artifacts.

• Standing global admin or super admin accounts — some without strong MFA, some without anyone remembering why they exist.

• Legacy authentication still enabled while conditional access looks healthy on paper.

• Posture that was "fine at baseline" until a setting drifted and nobody got a readable alert.

Native admin UIs are authoritative. They are also fragmented, role-gated, and poor at telling a continuous improvement story for boards, insurers, and assessors.

SSPM in XISEM does not replace Microsoft Entra, Google Admin, or your GRC platform. XISEM extends and operationalizes tenant evidence — the same alliance posture we describe in STAP: enrich, correlate, score, act.

What SSPM watches

SSPM scans baseline posture across identity, mail, files, devices, sharing, admin sprawl, and audit settings — then alerts only when something actually changes.

• Identity & MFA hygiene — Phishing-resistant MFA gaps, legacy auth, conditional access drift, and stale privileged accounts.

• Mail flow & forwarding — External forwarding rules, autoforward, transport rules, and exfil-shaped mailbox behavior.

• Sharing & DLP exposure — Anyone-with-link, external collaborators, sensitive labels, and policy bypasses across Drive and SharePoint.

• Admin sprawl — Global admins, super admins, delegated roles, and standing privilege that should be just-in-time.

• Policy drift — Baseline plus deviation. XISEM snapshots your posture and escalates when configuration moves — not when a static report ages out.

• Audit-ready evidence — Every finding is timestamped, scoped to the right client organization, and bound to your compliance mappings.

Findings are deduplicated, scored, and pre-mapped to frameworks your program already contracts — CIS, NIST, CMMC, ISO, and dozens more — so "prove posture" is not a weekend of screenshots.

Connect → Scan → Score → Remediate

SSPM is designed for operators who cannot afford a six-month integration project:

1. Connect — OAuth into Microsoft 365 and Google Workspace. Read-only by default. No agents, no proxies, revocable from your tenant any time.

2. Scan — Baseline posture across identity, mail, files, sharing, admin sprawl, and audit settings — typically within minutes of connect.

3. Score — Findings roll up into your ASPIRE score and feed COBRA² detections plus compliance bindings.

4. Remediate — Approve fixes manually, ship one-click containment, or hand off to a managed XISEM tier — your call.

No rip-and-replace. No migration. Twelve minutes from OAuth to a posture truth your team can act on Monday morning.

SSPM and Visa: two lenses, one platform

Cloud SaaS risk splits naturally into two questions:

• What is configured in the tenant? — SSPM owns the broader SaaS control plane: identity hygiene, mail, sharing, admin sprawl, drift.

• What apps and trust relationships hold OAuth privilege? — XISEM Visa owns the app estate and cross-tenant trust: App Registrations, Enterprise Apps, scopes, consent users, XT partners, cross-domain delegation.

SSPM might flag a global admin without phishing-resistant MFA. Visa might show that same admin consented a high-privilege third-party app last week. Anti-Venom Secure Access might reveal users opening a shadow SaaS domain daily. SaaS / Cloud MFA Coverage might show those logins were never stepped up.

Used ≠ authorized ≠ MFA-safe ≠ tenant-hardened. XISEM keeps the lenses separate and the verdict unified.

Related: dual-strike.com/visa · dual-strike.com/antivenom · dual-strike.com/shadow-ai

A surface, not a silo

Most standalone SSPM tools stop at a dashboard of findings. In Dual-Strike XISEM, SaaS posture is one more evidence stream:

• ASPIRE — Posture score moves like a vital sign; every change traceable to a control, a finding, and a fix.

• COBRA² — Detections and correlation across identity, endpoint, browser, and tenant signals.

• Compliance — Findings bind to control mappings, POA&M, and assessor-ready binders.

• SOAR & containment — One-click escalation where your runbooks support it.

One platform. One canonical Gateway per client organization. One verdict operators can defend.

What we do not claim

Honesty matters in SaaS security sales:

• SSPM does not replace Microsoft Entra, Google Workspace Admin, or your CASB. XISEM operationalizes tenant evidence those systems produce.

• SSPM does not substitute for DLP legal review or data-classification policy — it surfaces misconfigurations and exposure paths with readable proof.

• SSPM does not guarantee compliance attestation by itself. It feeds the evidence layer your GRC and assessor workflows consume.

• SSPM does not require agent deployment for baseline tenant scan — Gateways connect read-only. Endpoint and browser siblings add depth where you enable them.

Who this is for

• MSP and MSSP operators standardizing M365 and Google posture across a portfolio

• vCISO teams who need drift visibility between audit windows — not annual screenshot archaeology

• Compliance managers mapping live tenant findings to CIS, NIST, CMMC, and insurer questionnaires

• Organizations pairing SSPM with Visa and Anti-Venom for authority, attribution, and endpoint/browser depth

Next step

If your SaaS tenants pass an assessment week but cannot prove readiness on an ordinary Tuesday, start here:

dual-strike.com/sspm · Connect Microsoft 365 · Connect Google Workspace · Request a demo

Connect your tenants. See the truth in twelve minutes.

— The Dual-Strike team

Your identity provider already knows which cloud apps hold privilege in the tenant. The problem is not that the data is missing — it is that nobody operationalizes it.

An permitted user opts the entire organization into a third-party SaaS app. A custom App Registration lands with mail, files, or role-management scopes. A cross-tenant partner relationship opens with inbound trust and auto-consent posture buried in admin portals. Consent is not authorization — but without a control loop, it becomes standing access anyway.

Dual-Strike XISEM Visa is the cloud app, OAuth, and cross-tenant trust surface in XISEM. Visa inventories what the identity provider authorizes, escalates when posture changes, supports analyst and certification review, and finishes with SOAR playbooks that revoke grants, disable apps, or remove them from the tenant.

Every cloud app needs a visa to operate in your tenant. Issue them deliberately. Revoke the rest.

Explore: dual-strike.com/visa · dual-strike.com

The gap in plain language

Most organizations discover cloud app risk in one of three painful ways:

• A user with consent rights grants org-wide access to a SaaS tool nobody in security has reviewed.

• An attacker or insider registers a custom application that holds secrets, certificates, or high-privilege Graph permissions.

• A guest-join or B2B cross-tenant path opens a trust relationship that analysts only find after an incident.

Microsoft Entra and Google Workspace Admin Console hold the truth. What they do not provide, by themselves, is a continuous control loop — readable inventory, deduplicated alerts, certification review, and evidence-backed response in the same platform where your analysts already work.

Visa closes that loop. It does not replace Entra or Google Admin. XISEM extends and operationalizes the evidence those systems produce — the same STAP posture we take with EDR, DNS, and identity: enrich, correlate, act.

Available now: what Visa inventories

Visa mirrors identity-provider truth — not browser discovery. Operators filter by provider, app kind, and permission mode. Trust & Guests isolates cross-org relationships that are easy to miss in native admin UIs.

• App Registrations — Custom Entra app registrations that can hold secrets, certificates, and Graph permissions — inventoried with publisher, permission mode, and first / last seen.

• Enterprise Apps — Service principals and enterprise applications in the directory — including app-only (application) permissions that never touch a human identity.

• Scopes & permission modes — Delegated scopes and application roles side by side. Filter by application vs delegated; high-risk scopes (mail, files, role management) are called out for triage.

• Consent users — User consent footprint and admin-consent flags — who granted what, whether the org is opted in, and how wide the blast radius is.

• Cross-tenant partners (XT Partners) — Entra cross-tenant partner orgs — default domain, inbound and outbound trust, auto-consent posture — so guest-join and B2B relationships are visible, not buried in portal JSON.

• Trust & Guests / cross-domain — Dedicated view for cross-org trust and Google domain-wide delegation. Correlate with guest invite / redeem and cross-tenant sign-in events.

Evidence arrives through Microsoft Entra and Google Workspace Gateways — read-only connectors that harvest OAuth app catalogs, consent posture, and trust relationships into durable Visa rows.

Consent is not authorization

Visa exists because the most common cloud-app failures are authorization failures dressed up as convenience:

• App Regs & Enterprise Apps — Custom registrations and enterprise apps that gain directory, mail, or Azure function without a security review.

• Org-wide SaaS consent — A permitted user opts the entire organization into a third-party SaaS app — Visa sees the grant, scores the scopes, and escalates.

• High-privilege scopes — Mail.ReadWrite, Files.ReadWrite.All, RoleManagement — alerted with labeled evidence for analysts, not a raw API dump.

• XT partners & guest-join — Cross-tenant partners with inbound / outbound trust and auto-consent — the path a rogue invite → accept → guest join can exploit.

• Consent requested & attempted — Admin consent requests and attempted grants surface before they become standing access.

• SOAR revoke & disable — Kill the OAuth grant, disable the service principal, or remove the app — with approval gates for destructive actions.

Readable evidence is the default story. Raw JSON remains available as an audit appendix — not the primary analyst view.

Inventory → Detect → Review → Act

Visa runs one control loop for the entire cloud app estate:

1. Inventory — App Registrations, Enterprise Apps, OAuth clients, scopes, consent users, XT partners, and cross-domain trust — durable rows in Visa from Entra and Google Workspace Gateways.

2. Detect — Posture-deduped alerts when a new app appears, high-privilege scopes land, or consent is requested or attempted — escalated through Alerts, Lookout, and COBRA².

3. Review — Analyst and certification review of publisher trust, application vs delegated permissions, partner inbound/outbound trust, and risk tier.

4. Act — SOAR playbooks revoke OAuth grants, disable the app, or remove it from the tenant — human-gated when destructive, evidence-backed when complete.

That loop is the difference between knowing apps exist in a portal and governing them as a security program.

Authority, attribution, and MFA coverage

Visa answers what is authorized in the identity provider. Sibling XISEM surfaces answer adjacent questions — without merging product names or confusing discovery with permission.

• SaaS App Attribution (Anti-Venom Secure Access) — What is used — browser-observed SaaS domains users actually open, including shadow and sanctioned apps from session telemetry, not only what the IdP lists.

• Visa — What is authorized — whether that app (or a parallel Graph or Workspace grant) holds consented privilege, and whether an XT partner or cross-domain trust path exists.

• SaaS / Cloud MFA Coverage — Was it stepped up — browser-attested login events show whether SaaS and cloud sign-ins challenged MFA, with gap analysis by app and by user.

• SSPM — Tenant posture — identity hygiene, mail flow, sharing, and admin sprawl across the broader SaaS control plane. Visa owns the app estate and cross-tenant trust; SSPM owns tenant-wide configuration drift.

• Shadow AI — AI sprawl — unsanctioned AI tools in browser, local CLI, and Copilot surfaces. When an AI product also holds Graph or Workspace grants, Visa is the revoke path.

One verdict, three lenses: Used ≠ authorized ≠ MFA-safe. When any lens fails, SOAR and certification campaigns close the loop.

Part of the XISEM family — not Anti-Venom

Product names should tell operators where to look:

• Scout watches endpoints.

• Sonar watches networks.

• Visa watches cloud apps and cross-tenant trust.

• Anti-Venom protects the browse path — Secure Access, Secure Resolve, Secure Elevate, Secure Control.

Lookout notifies technicians. COBRA² correlates. ASPIRE scores Access when OAuth and MFA posture move. One platform — clear product names.

What we do not claim

Public buyers deserve precision:

• Visa does not replace Microsoft Entra, Google Workspace Admin, or your identity provider's native app governance. XISEM extends and operationalizes that evidence.

• Visa does not enforce Conditional Access by itself. Inventory presence is not a policy engine.

• Visa does not substitute browser discovery for IdP authority — and vice versa. Both lenses matter.

• Visa does not ask you to rip out your CASB or SSPM vendor. Keep them. XISEM correlates what they cannot see alone when Gateways and sibling surfaces are connected.

Who this is for

• MSP and MSSP security leads managing multi-tenant M365 and Google Workspace portfolios

• vCISO and identity teams tired of Graph JSON archaeology for OAuth reviews

• Compliance and audit stakeholders who need readable evidence chains for app consent and cross-tenant trust

• Organizations closing Shadow AI and SaaS sprawl — where browser attribution finds usage and Visa confirms grants

Next step

If your cloud app estate lives in admin portals nobody reviews until something breaks, start here:

dual-strike.com/visa · dual-strike.com · Connect your Entra or Google Workspace Gateway · Request a demo

Issue visas deliberately. Revoke the rest.

— The Dual-Strike team

Government and defense-industrial cybersecurity has a calendar problem.

Most programs can assemble a binder for an assessment window. Fewer can answer — today — whether they are audit-ready against the frameworks they contracted, which controls fail with proof, and which remediations will move posture this sprint.

Authorizing officials want trajectory. Assessors want evidence. Operators want actions. Spreadsheet POA&Ms and annual screenshot archaeology satisfy none of them for long.

Dual-Strike XISEM for Government (XISEM GOV) is the cyber operations platform for that reality: discover, secure, measure, and continuously prove compliance posture across mission systems, identities, endpoints, and enclaved workloads.

One platform to discover, secure, measure, and continuously prove compliance posture across every mission system, identity, endpoint, and enclaved workload.

Explore: dual-strike.com/solutions/government

The government problem in plain language

Agencies, state programs, and Defense Industrial Base contractors drown in point tools. Each tool owns a slice of truth. None owns the program narrative.

The failure mode is predictable:

• NIST and CMMC readiness lives in a GRC spreadsheet that lags live systems by months.

• FedRAMP-family and StateRAMP programs scramble between 3PAO milestones instead of operating posture every day.

• Privileged access is still standing admin because “the maintenance window required it.”

• Browsing and SaaS risk — including Shadow AI and exfiltration-oriented behavior — sits outside the compliance story for Controlled Unclassified Information and export-sensitive work.

• When an assessor asks for proof, the answer is a folder of screenshots with no provenance chain.

XISEM GOV is not another SIEM that only stores logs, and it is not a GRC tool that only tracks policies. It turns live telemetry into defensible control evidence, plans of action and milestones (POA&M), and assessor-ready binders — every day.

GRC tracks intent. XISEM feeds evidence. They complement.

Built for framework-first missions

Government buyers are measured against frameworks — not feature lists. XISEM GOV maps evidence already in the platform to the programs those missions live under:

• Program pressure: ------------------ · Meet: ------ · Exceed: --------

• Program pressure: NIST CSF / SP 800-53 / SP 800-171 · Meet: Live control mapping and daily evidence against the frameworks your program contracts · Exceed: ASPIRE™ / MAVICE℠ trajectory an authorizing official or CISO can defend — not annual screenshot archaeology

• Program pressure: CMMC Levels 1–3 · Meet: Level-scoped packs, POA&M, and readable evidence chains for CUI environments · Exceed: Ranked remediation that moves assessor outcomes this sprint — not spreadsheet theater

• Program pressure: FedRAMP / GovRAMP / StateRAMP / TX-RAMP · Meet: Framework operations, binders, and accreditation-status tracking between 3PAO milestones · Exceed: Continuous posture without claiming an authorization Dual-Strike has not officially attained

Framework center of gravity: NIST CSF 2.0 · NIST 800-171 · NIST 800-53 · CMMC L1–L3 · FedRAMP · GovRAMP · StateRAMP · TX-RAMP · ITAR-supporting program controls · DFARS cyber expectations

Meet the frameworks. Exceed the binder scramble.

What an authorizing official actually needs

Framework-first compliance

Select the contracted set — NIST CSF, 800-171, 800-53, CMMC, FedRAMP-family packs — and operate against that set with evidence refreshed daily. Framework mapping only hurts when it is a January spreadsheet. Tie controls to live telemetry and compliance becomes a running program, not a fire drill.

POA&M and binders with provenance

Remediation needs owners, due dates, and proof. XISEM GOV generates POA&M from live control failures and packages assessor-ready binders with mappings, evidence, and provenance — so the package is a product of operations, not a weekend of archaeology.

Secure Elevate — least privilege you can defend

Standing administrator rights are a recurring finding and a recurring incident path. Secure Elevate eliminates standing admin and replaces it with just-in-time elevation with evidence for privileged workflows — the kind of access story an assessor and a program security officer can both accept.

Secure Resolve and Secure Access — endpoint and browsing risk in the compliance story

Secure Resolve blocks phishing, malware, and malicious domains at the endpoint. Secure Access (Anti-Venom Secure Access) surfaces browser extensions, Shadow AI, risky SaaS, and exfiltration-oriented browsing — including signals that matter for CUI and export-sensitive environments.

Endpoint and browser risk are not “IT hygiene side quests.” They are control evidence.

ASPIRE™ and MAVICE℠ — executive truth with drill-down

ASPIRE™ answers technical posture. MAVICE℠ answers maturity. Together they support the questions authorizing officials, CISOs, and boards actually ask:

• Are we audit-ready against our contracted frameworks today?

• Which controls fail, and what evidence proves it?

• What are the top remediations that move CMMC / NIST posture this sprint?

• Can we show continuous improvement to an AO, 3PAO, prime, or board?

Vendor scores without evidence are theater. Scores with drill-down to readable proof are a management system.

Readable evidence doctrine

Assessors and analysts should not be asked to decode raw JSON as the primary story. XISEM presents human-readable, complete evidence — labeled fields, structured detail, full pertinent facts. Raw JSON remains available as an audit appendix, not the default narrative.

That doctrine matters when a C3PAO or agency reviewer opens the console. They get evidence chains and binders — not an opaque vendor dashboard as the only artifact.

Siloed mission tenancy

Client and agency data stays siloed. Attribution is enforced at write time. Managed service provider rollups must not bleed one mission’s identities, events, or assets into another. Isolation is not a UI filter; it is a platform rule.

FedRAMP journey surfaces — honest by design

XISEM GOV includes accreditation-status tracking and compliance POA&M surfaces for executive reporting between 3PAO milestones. That is operational support for a FedRAMP-oriented journey.

It is not a claim that Dual-Strike is FedRAMP authorized unless that status is separately attained and published. We support FedRAMP-oriented operations and evidence. Authorization status is separate — and we will not pretend otherwise.

ITAR-supporting controls — not a legal determination engine

For export-controlled programs, XISEM GOV supports the program security story: identity hygiene, least privilege, endpoint controls, and browsing / exfiltration-oriented signals with defensible audit evidence.

Legal ITAR determinations stay with counsel and the Empowered Official. The platform supports the controls; it does not replace the legal determination.

Designed for operators, not alert theater

A Cyber Operations Platform does three jobs well:

1. Discover the mission footprint — assets, identities, SaaS, endpoints

2. Secure with Elevate / Resolve / Access — least privilege and endpoint / browsing risk

3. Prove with daily evidence, POA&M, binders, and ASPIRE / MAVICE trajectory

Logs are inputs. Evidence is the product. Action is the outcome.

That is why XISEM GOV fits agencies, DIB primes and subcontractors, state and local programs under GovRAMP / StateRAMP / TX-RAMP pressure, and government-focused MSPs who cannot afford another console that only pages people.

What we do not claim

Public-sector buyers deserve precision:

• We do not claim FedRAMP authorization Dual-Strike has not officially attained.

• We do not issue ITAR licenses or legal determinations.

• We do not replace agency SOC-as-a-service mandates or official PMO / ATO packages.

• We do not position XISEM as “instead of” your EDR, identity provider, or GRC system — we extend and operationalize evidence those systems produce.

Who this is for

• CISOs, ISSOs, and compliance managers who live under NIST / CMMC calendars

• Authorizing officials, CIOs, and program executives who need trajectory, not theater

• Defense Industrial Base primes and subcontractors protecting CUI

• State and local programs under GovRAMP / StateRAMP / TX-RAMP expectations

• C3PAOs, systems integrators, and government MSPs / MSSPs who need readable evidence packages

Next step

If your program can pass an assessment week but cannot prove readiness on an ordinary Tuesday, start here:

dual-strike.com/solutions/government · Contact government sales · Request a demo

Audit-ready today. Every day.

— The Dual-Strike team

K-12 cybersecurity has a visibility problem dressed up as a tooling problem.

Most districts already own an endpoint product, a filter, and a Microsoft 365 or Google Workspace tenancy. What they rarely own is a single, honest answer to the questions a superintendent and a school board actually ask:

1. Are we more secure than last month?

2. Which schools or campuses are at greatest risk?

3. What are the top five actions that will improve our posture?

4. Can we prove improvement for grants, insurers, and state reporting?

Those are not SIEM questions. They are operations questions. Dual-Strike XISEM for Education (XISEM EDU) is built for that reality: a cyber operations platform for districts that do not have a twenty-person security operations center — and should not need one to run a defensible program.

One platform to discover, secure, measure, and prove continuous improvement across every student, staff member, classroom, and campus.

Explore: dual-strike.com/solutions/education

The district problem in plain language

Schools face ransomware, credential theft, and data exposure with staffing that would be called “under-resourced” in any private enterprise. Point tools create alert noise. Boards and grantors ask for measurable improvement, not another dashboard login.

The failure mode is familiar:

• Inventory lives in three places and none of them know about the smart board, the lab printer, or the Chromebook that never joined the right OU.

• Teachers still have standing local admin “because the projector driver broke last semester.”

• Filtering works on campus and softens once students and staff leave the network.

• Compliance evidence is assembled in January for a binder that is stale by March.

• When something happens, the story is scattered across logs, tickets, and screenshots — not a readable timeline a small team can act on.

XISEM EDU does not ask districts to throw away what already works. It correlates identity, assets, browsing, endpoint controls, and compliance evidence into one posture story those tools cannot tell alone.

Built for the Enhancing K-12 Cybersecurity Act agenda

The bipartisan Enhancing K-12 Cybersecurity Act (reintroduced 2023) points CISA toward three outcomes for primary and secondary schools:

1. Information, best practices, and training through a cybersecurity information exchange

2. Incident visibility through voluntary K-12 cyber incident tracking

3. Technology improvement — helping schools deploy cybersecurity capabilities against real risks to school information systems

XISEM EDU is not a substitute for CISA programs or mandated reporting. It is the district operating layer that turns that agenda into daily posture, measurable improvement, and audit-ready proof.

• What the Act pushes toward: ---------------------------- · How XISEM EDU meets it: ------------------------ · How XISEM EDU goes further: ----------------------------

• What the Act pushes toward: Information, best practices & training · How XISEM EDU meets it: CISA-aligned guidance in live compliance dashboards — not a static PDF toolkit · How XISEM EDU goes further: Live top-five actions and campus risk ranking every day

• What the Act pushes toward: Incident tracking & threat landscape · How XISEM EDU meets it: Evidence-driven detections, alerts, and readable investigation timelines · How XISEM EDU goes further: Optional Community Gateway — anonymized ESC/SEA trends without student PII

• What the Act pushes toward: Deploy cybersecurity capabilities · How XISEM EDU meets it: Scout agents, Secure Elevate / Resolve / Access, Microsoft 365 + Google Workspace + Active Directory identity · How XISEM EDU goes further: Automated grant evidence — before/after posture and control proof packs

Meet the Act. Exceed the toolkit.

What a superintendent actually needs

Complete campus discovery

Security programs fail when they only know about the Windows laptop that enrolled cleanly. XISEM EDU discovers across the real campus footprint: Windows, macOS, Chromebooks (where supported), Linux, mobile, network gear, printers, IoT, cameras, smart boards, and lab equipment.

You cannot protect what you cannot see — and you cannot rank campus risk without a complete inventory.

Identity for schools

Districts run hybrid identity worlds. XISEM EDU correlates Microsoft 365, Google Workspace, and Active Directory / LDAP so dormant accounts, privilege creep, and impossible travel / geo-velocity show up as identity posture — with staff versus student context where the environment supports it.

Identity is not a separate product silo. It is part of the same story as the device and the browsing session.

Secure Elevate — end standing admin for teachers and IT

Standing local administrator rights are still one of the most common ways a phishing click becomes a district-wide incident. Secure Elevate eliminates permanent teacher and IT admin rights and replaces them with just-in-time elevation with evidence — so helpdesk workflows still work, and auditors can see who elevated, when, and why.

Secure Resolve — protection that travels

Students and staff leave campus. Threats do not respect the firewall. Secure Resolve blocks phishing, malware, and inappropriate domains at the endpoint — on campus or at home — so filtering posture is not a building-hours feature.

Secure Access — Shadow AI, risky SaaS, and browser risk

Classroom and staff browsing is where Shadow AI tools, risky SaaS, and exfiltration-oriented behavior show up first. Secure Access (Anti-Venom Secure Access) monitors browser extensions, Shadow AI usage, risky SaaS, and data-exfiltration oriented browsing signals — so IT can teach, policy, and remediate with facts instead of rumor.

Compliance without the binder chase

Grantors, insurers, and state programs ask for alignment to CIS Controls, NIST Cybersecurity Framework, and CISA K-12 guidance. XISEM EDU maps live evidence into compliance dashboards, daily control refresh, plans of action and milestones (POA&M), and grant-ready packs — so “prove improvement” is not a weekend of screenshots.

ASPIRE™ and MAVICE℠ — scores that answer human questions

ASPIRE™ is technical posture truth. MAVICE℠ is maturity. Together they answer board-level questions without translating ten thousand alerts:

• Are we more secure than last month?

• Which campuses are at risk?

• What are the top five actions?

Scores without drill-down are vanity. XISEM EDU ties letter grades and trends back to evidence a small team can act on.

Community Gateway (optional) — share trends, not student data

Educational Service Centers and State Education Agencies need regional awareness without becoming a privacy liability. The optional Community Gateway supports anonymized, aggregated rollups for ransomware, phishing, and vulnerable-technology trends — without exposing student personally identifiable information in shared telemetry.

Districts stay siloed. Shared views stay privacy-first and FERPA-aware by design.

Designed for thin IT teams

XISEM EDU is intentionally not another alert factory.

A district with two or three technology staff members cannot live inside a log warehouse. They need:

• Discovery that covers classroom reality

• Controls that fit helpdesk workflows (Elevate / Resolve / Access)

• Measurement a superintendent can understand

• Evidence that survives a grant review or insurance questionnaire

That is the difference between a cyber operations platform and a pile of point products that never become a program.

What we do not claim

Honesty matters in public sector sales:

• XISEM EDU does not replace CISA, MS-ISAC, or mandated incident reporting to federal or state agencies.

• It does not claim to be a complete legal FERPA determination engine — it supports a privacy-aware operating posture (siloed tenants, minimized student data in shared views, anonymized community trends).

• It does not ask you to rip out your EDR or web filter. Keep them. XISEM correlates what they cannot see alone.

Who this is for

• District CIOs and Directors of Technology

• Superintendents and board cyber committees who need measurable improvement

• Educational Service Centers and State Education Agency cybersecurity coordinators

• Education-focused MSPs and MSSPs supporting multi-district portfolios

Next step

If your district is drowning in tools and still cannot answer “are we better than last month,” start here:

dual-strike.com/solutions/education · Contact education sales · Request a demo

Secure the classroom. Prove the posture.

— The Dual-Strike team

If you run an MSP, you already bought the stack. PSA. RMM. EDR. Identity. DNS. Browser controls. You don't need another vendor telling you to rip and replace.

You need a Cyber Operations Platform that makes what you already run more valuable — correlated, reportable, and actionable for technicians and executives alike.

That's what the Strategic Technology Alliance Program (STAP) is for.

STAP is not an integrations program. It's a technology alliance framework: mutual value between Vysion Technology Solutions, alliance partners, MSPs, MSSPs, MIPs, and shared customers.

What STAP means for your operation

Dual-Strike XISEM extends, enriches, operationalizes, and orchestrates existing technology investments. Every alliance partner should feel that XISEM improves adoption, visibility, executive reporting, operational intelligence, and customer outcomes for their platform.

Three concepts to remember:

1. Cyber Operations Platform — XISEM is the layer above your tools, not a substitute for them.

2. Shared Security Context — telemetry from every alliance enriches every other source continuously.

3. Operational Intelligence — correlated events become decisions your team can act on Monday morning.

Shared Security Context

Products don't operate in silos. Telemetry from Microsoft, EDR, identity, DNS, browsers, Scout, and alliance gateways flows into one shared context — then becomes Operational Intelligence.

```mermaid

flowchart TB

MS[Microsoft]

S1[SentinelOne]

TL[ThreatLocker]

GZ[Guardz]

PT[Petra]

DNS[DNS]

BR[Browsers]

ID[Identity]

SC[Scout]

SN[Sonar]

CB[COBRA²]

SSC[Shared Security Context]

OI[Operational Intelligence]

MS --> SSC

S1 --> SSC

TL --> SSC

GZ --> SSC

PT --> SSC

DNS --> SSC

BR --> SSC

ID --> SSC

SC --> SSC

SN --> SSC

CB --> SSC

SSC --> OI

```

Messaging: do this, not that

• XISEM replaces SentinelOne — XISEM operationalizes SentinelOne telemetry

• XISEM replaces ThreatLocker — XISEM extends ThreatLocker policy intelligence through Shared Security Context

• XISEM replaces Huntress — XISEM enriches Huntress detections with browser, identity, DNS, compliance, and organizational context

• XISEM integrates with Guardz — XISEM operationalizes Guardz intelligence through graph correlation and executive reporting

Never state or imply: replace · compete with · alternative to · instead of

Preferred language: extends · enriches · correlates · operationalizes · orchestrates · amplifies · unifies · enhances

Launch Packs (curated onboarding)

STAP onboarding is organized into Launch Packs — not one-off vendor checkboxes:

• MSP Essentials — XISEM, SuperOps, Microsoft 365, Anti-Venom

• Identity Protection — XISEM, Petra, Keeper

• Business Protection — XISEM, Guardz, Anti-Venom

• Endpoint Security — XISEM, SentinelOne, ThreatLocker, Huntress

• Compliance — XISEM, Petra, ASPIRE, MAVICE, CAA

Select a Launch Pack in Partner Center → New Prospect when standing up a new evaluation.

Priority alliances (where we're investing first)

Priority 1: SuperOps · Petra · Guardz

Priority 2: SentinelOne · ThreatLocker · Huntress · Keeper · Proofpoint · DNSFilter

Each alliance in Partner Center shows status, gateway availability, Launch Pack placement, evaluation support, and documentation links.

What you can do today

• Explore alliances: dual-strike.com/partners

• Program overview: dual-strike.com/support/stap-strategic-technology-alliance-program

• MSP partners: apply through Partner Center for Launch Packs, evaluations, and federation

We won't ask you to abandon the vendors your clients already trust. We will help you operationalize them — together — through Shared Security Context.

— The Dual-Strike team

Roaming DNS is still the quiet gap in endpoint security.

Users leave the office. VPN split-tunnel fights the roaming client. Windows 11 enables encrypted DNS in Settings. Browsers send queries around the OS resolver. The SIEM gets a vendor export from last month — not proof that a block happened on this laptop, for this user, now.

Anti-Venom Secure Access already covers the browser: session telemetry, verdict watermarks, AI-tool visibility, and policy in Chrome, Edge, and Firefox — correlated in Browsing Insights and investigations.

Today we name the network half:

Anti-Venom Secure Resolve

Dual-Strike XISEM’s first-party endpoint DNS protection — a lightweight bolt-on that works with Secure Access, not instead of it.

• Browser — Anti-Venom Secure Access — Tabs, sessions, phishing paths, SaaS and AI-tool policy

• Network / resolver — Anti-Venom Secure Resolve — OS and app DNS before traffic leaves the endpoint

Same Anti-Venom family. Different surface. One correlated picture in the console.

Why two products?

No single hook sees every query.

• Secure Access — inside the browser, including DoH bypass paths and session-level policy

• Secure Resolve — at the system resolver: apps, scripts, and background agents that never open a tab

Together they cover home ISP routers, split-tunnel VPN, Win10/Win11 encrypted DNS, and non-browser software that still phones home over DNS. Neither replaces your EDR. Both feed Dual-Strike XISEM’s evidence doctrine — neutral facts in, correlated posture and investigations out.

What Secure Resolve does

Paired with the Dual-Strike XISEM Agent on Windows 10 and 11:

• Local-first policy — lists cached on the endpoint; cloud for sync and evidence

• VPN- and NRPT-aware — internal zones stay on VPN DNS; yields to known relays instead of fighting them

• Encrypted upstream — aligned with modern Windows DoH/DoT

• Evidence in the same pane — batched query and block events for ASPIRE, COBRA², and investigations

• MSP policy packs — one baseline, per-client exceptions, approve/deny without a second vendor console

• Learning mode first — log would-block before enforce, like Secure Access

Defense in depth: Resolve blocks C2 and unwanted categories at the resolver. Secure Access enforces browser policy on what users actually visit. When browser DoH bypasses OS DNS, Secure Access still sees it. When malware resolves a domain outside the browser, Secure Resolve still sees it.

Your DNS, your choice

Already on DNSFilter or another DNS Gateway? Keep it. Third-party DNS stays in the open integration fabric — evidence in, correlation out. Secure Resolve is the first-party bolt-on for MSPs who want policy and unblock workflow inside Dual-Strike XISEM. Run either, or both while you migrate.

Who it is for

MSPs standardizing browser and resolver policy on one console. vCISO teams tired of “DNS active” posture with no per-endpoint proof. Distributed shops where legacy roaming clients break on VPN and Win11. Existing Secure Access customers adding resolver coverage without a second product story.

Availability

Anti-Venom Secure Resolve ships on the Dual-Strike XISEM Agent 8.8+ line as a bolt-on SKU — same release train as the Windows agent and Edge Scan Sensor.

• Now — Product naming and MSP preview enrollment

• Next — Windows resolver preview — audit mode and DNS evidence in investigations

• GA — Enforce mode, unified block/unblock with existing DNS Gateways, in-console policy packs

Early access: Reply here or reach us via dual-strike.com — share your Secure Access footprint, VPN mix, and any third-party DNS Gateway.

Already on Secure Access? No browser redeploy required. Resolve adds the resolver layer when you are ready.

Downloads (agent + extension today): dual-strike.com/downloads

Secure Access protects the browser. Secure Resolve protects the resolver. Dual-Strike XISEM connects both to identity, device, and investigation — so DNS is evidence, not a checkbox.

Anti-Venom Secure Access and Anti-Venom Secure Resolve are components of Dual-Strike XISEM. Third-party DNS integrations remain optional. Confirm current GA status on dual-strike.com before customer commitments.