Home
Solutions for MSSPs
Resources
Contact

Home
About
Features
Contact Us
Resources

FAQs for MSSPs

Get the Answers MSSPs Need Most:

Explore how CYBERSPAN^® fits your delivery model: from deployment options to anomaly detection, multi-tenant visibility, and client-ready support tools.

General Overview

What is CYBERSPAN®?

CYBERSPAN^® is a network detection and response (NDR) platform designed for flexible, multi-tenant deployments. It delivers real-time, behavior-based anomaly detection that MSSPs can deploy across client environments: without endpoint agents, cloud dependencies, or excessive alert noise.

Who is CYBERSPAN® for?

CYBERSPAN^® equips managed security service providers (MSSPs), managed service providers (MSPs), and IT teams with the tools to deliver scalable, defense-grade protection across multiple client environments. Its flexible deployment model supports on-prem, cloud, and hybrid architectures, making it ideal for providers managing complex, segmented networks.

What is the ROI of using CYBERSPAN®?

CYBERSPAN^® helps MSSPs boost SOC efficiency and scale services faster by reducing alert fatigue, lowering deployment friction, and delivering clear, actionable threat intelligence. It empowers MSSPs to enhance detection capabilities and drive recurring revenue, without the cost of fully managed response.

How does CYBERSPAN® differ from other cybersecurity solutions?

Unlike traditional SIEMs or EDRs, CYBERSPAN^® does not rely on pre-trained signatures or endpoint agents. It learns baseline network behavior through unsupervised models, adapting to each environment for precise anomaly detection.

Detection & Response

What type of alerts does CYBERSPAN® generate?

CYBERSPAN^® outputs contextualized threat events, not raw logs or low-value alerts. Events are enriched with metadata, behavioral evidence, and threat phase classification using MITRE ATT&CK^®.

Does it detect emerging threats and zero-days?

Yes. Because it’s behavior-based and doesn't rely on static threat signatures, CYBERSPAN^® is well-suited for detecting novel attacks, lateral movement, beaconing, exfiltration patterns, and command-and-control attempts.

How does CYBERSPAN® reduce alert fatigue?

It suppresses redundant noise by correlating events into high-fidelity threat stories, helping MSSP analysts focus on actionable incidents instead of chasing every blip in traffic.

Does CYBERSPAN® provide automated responses?

CYBERSPAN^® doesn’t directly block or stop threats. However, it provides customizable enrichment, recommended actions, and integration hooks for SOAR/SIEM platforms to trigger playbooks or notify SOC teams.existing workflows.

Deployment & Support

How do you support multi-tenant environments?

Each client deployment operates in an isolated environment and rolls up to a centralized MSSP console. Segmentation and access controls ensure visibility without cross-tenant exposure.

What are the deployment options?

Physical sensor (NUC-style appliance)
Virtual machine on local infrastructure
Cloud-hosted (MSSP- or client-side)

All options report to your unified MSSP dashboard.

What kind of support is available?

CYBERSPAN^® partners receive onboarding, documentation, integration support, and direct access to our engineering team for troubleshooting or feature requests.

Technology & Architecture

What technologies does CYBERSPAN® use?

CYBERSPAN^® leverages unsupervised AI/ML models, encrypted traffic analysis techniques that work without decryption, and event correlation mapped to MITRE ATT&CK^®. It’s engineered for high-performance local processing with support for STIG-hardening and sensor isolation.

How is CYBERSPAN® installed?

MSSPs can deploy CYBERSPAN^® as a virtual machine (on-prem or cloud), or via a pre-hardened physical appliance. Setup typically completes within a few hours and doesn’t require endpoint access or custom tuning.

How does CYBERSPAN® receive data?

It passively ingests metadata from network traffic using SPAN/TAP ports or mirror ports. There’s no need for inline or active network interference.

Can CYBERSPAN® integrate with other tools?

Yes. CYBERSPAN^®supports integrations via API and Syslog, allowing MSSPs to forward alerts to SIEMs, SOAR platforms, or ticketing systems. Alerts include enrichment and MITRE mappings for easy automation.

How do you prevent model drift in CYBERSPAN®?

CYBERSPAN^® uses a controlled, continuous learning approach. Each deployment starts with a burn-in period to baseline "normal" behavior, after which models are retrained on-prem incrementally using validated data, preventing unintentional drift. validated data, preventing unintentional drift.

How do you secure your AI models?

AI models operate within the local sensor environment and are never cloud-hosted. Updates are securely signed and verified, with no external exposure of model logic or training data.

Is CYBERSPAN® an agentless EDR?

No. CYBERSPAN^® is not an EDR, it’s a network-based detection platform. It provides visibility into east-west and north-south traffic without requiring agents or host instrumentation.

Privacy, Security & Compliance

Does CYBERSPAN® transmit or store client data externally?

No. All analysis occurs locally on the MSSP or client infrastructure. No packet payloads are stored or sent to the cloud, and no data leaves the environment.

Is CYBERSPAN® compliant with cybersecurity standards?

Yes. CYBERSPAN^® aligns aligns with key cybersecurity frameworks such as NIST 800-171 and supports compliance-ready deployments for regulated environments, including those serving the Defense Industrial Base (DIB).

Can I offer CYBERSPAN® as a white-label service?

CYBERSPAN^® can be integrated into your existing service offerings and branded stack. While it is not currently available as a full white-label solution, it supports flexible deployment models that allow you to deliver detection and response under your own service framework.

Didn’t find what you were looking for? Contact Us.

Facebook-f X-twitter Linkedin-in Instagram

Useful Links

Third Party Licenses

FAQs for SMBs

FAQs for MSSPs