The best stack on the planet — deployed and run for you.

ThreatDefend™ powered by CrowdStrike Falcon is fully managed mXDR. We deploy Falcon, our SOC acts on every tier from day one, and full ITDR is included from Essential.

In short

ThreatDefend™ powered by CrowdStrike Falcon is Vijilan's fully managed mXDR — “Our stack. Our SOC.” Vijilan deploys and runs CrowdStrike Falcon, and the SOC acts on every tier from day one (host isolation, account disable, eradication and recovery). Full ITDR is included from the entry Essential tier — something no competitor offers at entry. Pricing is a dual per-endpoint + per-user model across four tiers (Essential, Advanced, Premium, Elite), with ThreatLog™ SIEM and no data caps throughout.

The differentiator

Full ITDR is included from Essential. No competitor offers this at the entry tier.

Pricing is a dual model — endpoints × endpoint rate + users × user rate. The SOC acts on every tier from day one: host isolation, account disable, eradication and recovery.

Day 1

SOC acts
Essential
ITDR included
Advanced
15-min SLA
Premium
2 hunting teams

The tiers

Four packages. The SOC acts on every one.

Built on CrowdStrike Falcon (EDR, Identity, Discover, Spotlight, Exposure, OverWatch). ThreatLog™ SIEM with no data caps is included throughout.

Essential

  • SOC acts from day one
  • CrowdStrike Falcon, deployed and managed by Vijilan. Full ITDR included from the entry tier — no competitor does this.
  • CrowdStrike Falcon EDR + NGAV — fully deployed & managed
  • Full ITDR from day one — dark web, impossible travel, MFA fatigue, BEC, OAuth abuse, lateral movement
  • AD + Entra ID + Microsoft 365 monitoring
  • ThreatLog™ SIEM — no data caps (LogScale / Falcon NG-SIEM)
  • SOC acts at Essential — host isolation, account disable
  • White-label under the partner brand

Advanced

  • SOC acts · all tiers
  • Asset discovery, vulnerability assessment and a 15-minute SOC response SLA.
  • Everything in Essential, plus:
  • ThreatMap™ (Falcon Discover) — asset discovery, shadow IT
  • ThreatScan™ (Falcon Spotlight) — scanless vuln assessment, ExPRT.AI, CISA KEV
  • External attack surface management (EASM)
  • 15-minute SOC response SLA on confirmed incidents
  • ThreatAssess™ — 60-day free trial included

Premium

  • SOC acts + hunts
  • Two independent hunting teams — Vijilan SOC plus CrowdStrike OverWatch.
  • Everything in Advanced, plus:
  • Vijilan SOC proactive threat hunting (MITRE ATT&CK)
  • ThreatOverWatch™ (CrowdStrike OverWatch) — elite global hunting
  • CMMC Level 2 audit evidence package
  • SOC 2 Type 2 evidence + quarterly reporting
  • Named concierge analyst

Elite

  • Concierge · by invitation
  • Custom pricing and a dedicated senior analyst built around the environment.
  • Everything in Premium, plus:
  • Custom endpoint and user pricing
  • Named senior concierge analyst (exclusive)
  • Custom SLA · monthly threat intelligence briefing
  • IR retainer · vCISO access
  • Custom detection engineering for the environment

Modules · Falcon-dependent

Composable coverage. Outcomes, not module names.

Capabilities are named by what they do. The underlying CrowdStrike Falcon modules are managed entirely by the Vijilan SOC.

TD EDR

Managed endpoint

Managed endpoint detection & response on CrowdStrike Falcon.

TD SIEM

Managed SIEM

Managed Falcon Next-Gen SIEM / LogScale — no data caps.

TD ITDR

Identity response

Managed identity threat detection & response, included from Essential.

TD XPM

Exposure management

ThreatExpose™ / Falcon Exposure Management — Falcon-dependent.

TD Hunt

Threat hunting

Managed proactive threat hunting across the Falcon estate.

Praxis AI Engine

Machine speed. Human judgment.

One minute to contain.

Praxis is Vijilan's proprietary AI detection and investigation engine — the intelligence layer running inside our SOC on every alert, across every domain, before a human analyst acts. Praxis doesn't replace the human SOC; it makes our analysts operate at a speed and fidelity no purely human team can match.

Investigation

A LangGraph multi-agent pipeline auto-investigates every alert — correlating signals across all six domains simultaneously before presenting findings to the analyst.

Enrichment

IOC enrichment from threat intelligence feeds, MITRE ATT&CK technique mapping and severity scoring derived from real adversary behavior — not just CVE scores.

Triage

Automated alert triage separates confirmed threats from false positives before they reach a human analyst — reducing noise and ensuring every escalation is a real threat.

Context

RAG-powered threat context retrieves relevant historical patterns, similar incident precedents and client-specific environment data to inform every investigation decision.

What Praxis is not

Praxis is not an autonomous agent that replaces human judgment. It is a force multiplier — the AI layer that enriches, correlates and prioritizes so that human analysts spend their time on confirmed threats, not alert noise. Every containment decision is made by a trained human analyst informed by Praxis — not by an algorithm acting alone.