Tools and work in progress
Palisade is a free, open-source, single-file compiler that turns scanner exports, SCAP results, STIG checklists, threat intel and inventory sheets into control-mapped evidence without a single network call. Verdict is a Keith Systems reviewer-assist tool in development, designed to map that evidence to NIST, CMMC and HIPAA requirements and propose determinations a person confirms.
At a glance
Palisade turns raw security data into control-mapped evidence inside your browser. Verdict is designed to review that evidence against its requirement and hand a reasoned proposal to the person who decides.
Drop in scanner exports, SCAP results, STIG checklists, threat intel and inventory sheets. Get a control-mapped evidence package without one byte leaving the machine.
Free and public. Jacob Keith is a co-maintainer and named copyright holder. Not a Keith Systems commercial product.
Designed to map evidence to the exact requirement it answers, propose a determination with visible reasoning, and leave the final call with a person.
A Keith Systems concept. Not available yet, no users. Design partners welcome.
How they fit
Palisade · the problem
Scanners report findings. Assessors want inventories, STIG coverage, port registries and POA&M rows. The gap is where hours and sensitive data leak away.
Reshaping scan data, checklists, inventories and threat intel into control evidence is still mostly done by hand. The shortcuts are worse: online converters and web tools take host names, addresses, software lists and accounts somewhere you do not control.
Palisade compiles locally, in a browser. Its own security policy forbids the page from reaching the network at all.
No DoD program required. The core engine is framework-agnostic.
Palisade · why it is impressive
Each card is a documented design decision, made because the output is evidence someone will sign against.
No bundler or transpiler. Copy palisade.html anywhere and open it from file://. Nothing to deploy, nothing written to browser storage.
The file's own CSP sets connect-src, default-src and related sources to 'none'. Script runs only by its SHA-256, so markup injected by hostile scan data stays inert.
Drop .nessus, SCC .zip, .cklb and workbooks at once. Files route by content, not extension, or report why they did not.
Built on the browser's native DecompressionStream and CompressionStream, with no libraries and size caps that stop decompression bombs.
Rows are tagged scan, listing, both or manual. Listings never overwrite scan evidence or your edits; conflicts and look-alike hosts are flagged, not silently merged.
Each CVE gets a transparent 0 to 100 score with editable weights. You choose which score drives tiers, and P1 always means weaponized and present on your network.
Findings resolve to the action that closes them, ranked by risk retired, so fifty browser findings read as one upgrade. Unrecognized items are marked unparsed, not guessed.
Severity-tiered diffs against prior sessions, escalation when security tooling disappears, a burndown from saved sessions, and aging against your windows.
Twenty sections and five presets, each rendered by the same function as its tab. Output is a PDF-ready HTML file plus a foldered evidence .zip.
Palisade · inputs and outputs
Every export states which NIST 800-53 controls it supports, so an artifact explains itself.
| Input | Formats | How it is handled |
|---|---|---|
| Tenable scan exports | .nessus XML (preferred), Tenable CSV | From Tenable Nessus, Nessus Professional or Tenable Security Center. CSV must include the Plugin Output column, and the CVE column for intel fusion. Credentialed scans are required for software detection. |
| SCAP results | SCC XCCDF result .xml, or the SCC .zip | Per-rule results. A newer SCC run replaces an older one by its own date. The current V-ID is read from the Group. |
| STIG checklists | .ckl (XML), .cklb (STIG Viewer 3 JSON) | Manual review answers live here. A checklist decision is never overridden by SCC, and the same rule from both counts once. |
| Threat intel | .xlsx, .csv, .tsv keyed by CVE | Headers map by alias, longest phrase first. The header row is found by scoring the first ten rows. Multi-CVE cells split; Excel date serials become ISO dates; unmapped columns pass through. |
| HW/SW baselines | .xlsx, .csv, .tsv | Your documented inventory, combined or separate. Workbooks route per worksheet. Hardware that never scans (switches, spares) still lands in the inventory. |
| Approval decisions | The review sheet Palisade exported, filled in | Only the four canonical statuses apply. "Unapproved" and "Not authorized" read as Denied; unknown wording stays Not Reviewed and is flagged. |
| Prior session | .json | Drift detection against a previous cycle, or trend backfill. Loads are transactional: a malformed file restores the previous dataset. |
| Environment profile | .json | Settings, detection rules and custom report presets so a team shares one setup. Never carries scan data. |
| Artifact | What it gives the reviewer | Supports |
|---|---|---|
STIG_Applicability.csv | Which STIGs apply to which hosts. Products found in scans switch on their own matrix column. | CM-6, CM-6(1), CM-2 |
STIG_Compliance_Summary.csv, STIG_Open_Findings.csv, STIG_Coverage.csv | Per-rule results, a printed scoring definition, and STIGs the matrix says apply but were never assessed. | CM-6, CM-6(1), CA-2, CA-7 |
Asset_Inventory.csv | Scan, listing and manual records merged, each row provenance-tagged. | CM-8, CM-8(1), PM-5 |
Asset_Reconciliation.csv | Coverage gaps in both directions: scanned but not listed, listed but never scanned. | CM-8, CM-8(3), RA-5 |
Software_Listing.csv, Approved_Software_Review.csv | Consolidated software with ambiguous duplicates flagged, plus an approval round trip. | CM-8, CM-10, SA-22, CM-2, CM-7(4), CM-11 |
eMASS_Hardware_Baseline.csv, eMASS_Software_Baseline.csv | Baselines in eMASS import shape. | CM-8 |
PPSM_Registry.txt, PPSM_WorkingCopy.csv | Listening ports, protocols and services per host. | CM-7, CM-7(1), SC-7 |
Account_Audit.csv | Dormant, stale-password and default accounts per host, with last-logon dates where the scan reported them. | AC-2, AC-2(3), AC-6(5), IA-4 |
Change_Record.csv | Per-host diff against the prior cycle, tiered by severity. | CM-3, CM-6(3), CM-11, SI-7 |
Unsupported_Components.csv | Components past vendor end of support. | SA-22, RA-5, SI-2 |
Remediation_Plan.csv, Prioritized_Vulnerabilities.csv | Ranked actions, not raw findings, with intel tiers and aging. | RA-5, RA-5(2), SI-5, SI-2 |
POAM_Draft.csv, POAM_Draft_STIG.csv | Evidence fields prefilled, decision fields left blank. | CA-5 |
Scan_Coverage.csv | Credentialed-scan verification per host. | RA-5, RA-5(1), RA-5(5) |
Trend_Burndown.csv | Posture direction across assessment cycles. | CA-7, PM-6 |
Control_Mapping.csv | The mapping itself, as a reviewable artifact. | All of the above |
Selected exports shown. The full list is in the project README.
Palisade · trust and supply chain
Palisade removes the build and the dependency tree, then publishes the documents a reviewer would otherwise have to request.
Policy
No host or scheme is a source for anything, so "no network calls" is machine-checkable.
Seal
Change one byte and the page loads inert. The whole-file digest covers someone who edits the entire file.
Checksums
SHA256SUMS, SHA384SUMS and MANIFEST.json (SHA-512 plus a markup digest) tie a copy to the repository.
SBOM
All seven NTIA minimum elements, with an explicitly empty component list. No dependencies, no dependency attacks.
Audit
No path from input to script execution. Of 87 other issues, 19 high, all but six are fixed in v2.9, and the six are explained.
Threat model
The air gap ends at the exported CSV, so formula-executing cells are neutralized on the way out.
Regression gate
A Chromium harness walks all 18 tabs from file://, asserting zero errors and zero CSP violations, and replays hostile audit inputs.
Accessibility
A VPAT-shaped WCAG 2.1 AA and Section 508 report that states where v2.8 does not fully conform, and why.
Reviewer packet
A NIST SP 800-218 map and a mobile-code determination for the reviewer who objects to "an HTML file with JavaScript in it."
default-src 'none';
script-src 'sha256-rXLlUraYkQK0AWyOdItde6nM7Vp4Okl31uF8o7Q6XsQ=';
style-src 'unsafe-inline'; img-src 'none'; font-src 'none';
connect-src 'none'; frame-src 'none'; worker-src 'none';
object-src 'none'; media-src 'none'; manifest-src 'none';
base-uri 'none'; form-action 'none'sha256sum -c SHA256SUMS
sha384sum -c SHA384SUMS
node tools/seal.mjs palisade.html --verify
bash tools/csp-lint.sh palisade.htmlNot there yet, by the project's own account: the release-attestation CI workflow had never run as of 2026-10-09, so no attestation exists. Until then, the digests and commands above are the evidence.
Palisade · compared
Not a scanner, GRC system of record or remediation engine: the offline compiler between them. Based on public documentation as of October 2026.
Palisade is strongest at browser-enforced offline operation, a provably empty dependency list, control-mapped evidence, multi-source fusion and field-level provenance.
It is intentionally empty elsewhere. Tenable, OpenSCAP and Grype scan. Telos Xacta 360 and RegScale are systems of record; Palisade keeps state in a session file you save.
Use Palisade with, not instead of. Scan with Nessus or Security Center, evaluate SCAP with OpenSCAP or SCC, record manual checks in STIG Viewer, fix with tools like Ansible Lockdown, track supply chain with Syft, Grype and Dependency-Track, and keep the record in your GRC platform. Palisade compiles their output into readable evidence, offline.
| Capability | Palisade | Tenable Nessus + Security Center | OpenSCAP | DISA STIG Viewer | Anchore Syft + Grype | OWASP Dependency-Track |
|---|---|---|---|---|---|---|
| What it is | Offline scan-to-evidence compiler | Vulnerability scanner (Nessus) and on-premises vulnerability management platform (Security Center) | SCAP scanning and reporting CLI1 | DISA desktop tool for STIG checklists | SBOM generator (Syft) and vulnerability scanner (Grype) | Continuous SBOM analysis platform |
| License | MIT | Commercial | LGPL-2.1 | Free from DISA (see DISA) | Apache-2.0 | Apache 2.0 |
| Nothing to deploy | Full: One HTML file opened from file:// |
None: Scanner plus server platform | None: CLI package on each host | Partial: Desktop app, Linux and Win64 | Partial: Single CLI binaries | None: Self-hosted containers with API server |
| Runs fully offline | Full: Enforced by CSP connect-src 'none' |
Partial: Offline registration and manual plugin updates; a few plugins need internet | Full: Local CLI | Desktop app; see DISA docs | Partial: Grype downloads its database first, then scans offline | Varies: vulnerability feeds are online |
| Scans systems or images | None: No, by design; reads scanner output | Full: Yes | Full: Evaluates hosts against SCAP content | None: Manual checklist review | Full: Images, filesystems and SBOMs | None: Analyzes uploaded SBOMs |
Reads Tenable .nessus exports |
Full: Preferred input | Full: Produces them2 | None: Not documented | None: Not documented | None: Not documented | None: Not documented |
| Rolls up SCAP and STIG checklists across hosts | Full: XCCDF plus .ckl/.cklb, with coverage reconciled |
See vendor docs | Partial: Per-host reports; no fleet view in a single HTML report | Partial: One checklist at a time, with scores and STIG comparisons | None: Not in scope | None: Not in scope |
| Exports mapped to NIST 800-53 controls | Full: Mapping in every export header | Partial: Hundreds of report templates, including compliance | Partial: HTML reports and ARF results | Partial: Checklist exports (CKL, CKLB, HTML, CSV) | None: Not in scope | None: Not in scope |
| eMASS-shaped baselines and PPSM rows | Full: First-class exports | See vendor docs | None: Not documented | None: Not documented | None: Not in scope | None: Not in scope |
| POA&M drafts | Full: Evidence prefilled, decisions blank | See vendor docs | None: Not documented | None: Not documented | None: Not in scope | None: Not in scope |
| Exploitation-aware prioritization | Full: Your CVE-keyed intel, editable weights, selectable score | Full: Built-in risk scores and threat intelligence | None: Not in scope | None: Not in scope | Full: Grype: EPSS, KEV and risk scoring | Partial: Re-checks inventory as new CVEs appear |
| Provenance on merged fields | Full: scan, listing, both or manual | See vendor docs | None: Single source | None: Single source | None: Not documented | See vendor docs |
| Generates SBOMs for your software | None: Ships its own SBOM; does not generate yours | See vendor docs | None: Not in scope | None: Not in scope | Full: CycloneDX, SPDX, Syft JSON, signed attestations | Partial: Consumes SBOMs (CycloneDX) |
| System of record and workflow | None: Session file you save; no standing database | Partial: Dashboards and ticketing | None: Not in scope | None: Not in scope | None: Not in scope | Partial: Standing component inventory |
| Changes system settings | None: Never; plans the fix, a person applies it | None: Not documented | Partial: Generates fix scripts | None: No | None: No | None: No |
oscap command line.Palisade · workflow
Illustrative, no timings claimed. The difference is fewer steps and handoffs, which is where errors and copies of sensitive data multiply.
Palisade · use cases
Each scenario uses outputs documented in the README.
01 · RMF package prep
STIG applicability, baselines, PPSM rows and POA&M drafts come from one model, and the assessor preset assembles them into one document.
02 · CMMC and NIST 800-171 readiness
Provenance-tagged inventories, an account audit and a change record give access control and configuration work real evidence.
03 · Isolated lab or enclave
Carry one file in, verify its digest, open from file:// and compile. Threat intel is whatever dated sheet you bring.
04 · MSP quarterly review
Last quarter's session gives a change record and burndown point; leadership gets four lenses. Environment profiles keep setups identical.
05 · Small office with a scan report
A .nessus or Tenable CSV becomes a ranked remediation plan and executive summary. Nessus Essentials documents no export.
06 · Pre-delivery QC
Readiness, scan health and coverage gaps show what is missing before shipping. Absent evidence fails, not passes.
Try any of these with the built-in demo: six synthetic hosts across every tab and export.
Verdict · in development
A Keith Systems reviewer-assist tool in development. Not available yet, no users. Everything here describes the planned design.
The planned promise
Read the evidence, find the requirement it answers, propose a determination with reasoning in view, answer follow-ups, then step aside while a person decides.
Every assessment ends with someone judging evidence against requirements: NIST SP 800-53A determination statements, the 110 NIST SP 800-171 R2 requirements of CMMC Level 2, the 15 FAR 52.204-21 requirements of Level 1, or HIPAA's safeguards.
The work is repetitive and largely redone each cycle. Pasting evidence into a chat assistant sends it out of your environment and returns prose with no mapping, record or memory.
Planned as a reviewer-assist layer. Not a GRC system of record, and it certifies nothing.
Planned: scan output, checklists, configuration exports and policies, including Palisade's artifacts.
Planned routing to control, procedure or determination statement, and CCI where used.
Planned to judge against the requirement as tailored for your system, not a generic entry.
Each proposal is designed to carry its reasoning and evidence, so reviewers check logic, not labels.
Ask why or what is missing. The thread is planned to stay with the determination for the next reviewer.
Planned so unchanged evidence is not re-reviewed and effort goes to what changed.
Ingest, mapping, reasoning and review are planned as separate, swappable modules.
Planned per client: fully local, your approved AI service, or no AI.
Designed to propose, never decide. A person accepts, edits or rejects, and that is what gets recorded.
Verdict · planned design
Planned design. Nothing here has shipped.
Mode A · Fully local
For environments that cannot send evidence anywhere. Planned to run on hardware you control.
Mode B · Your approved cloud
Evidence is designed to go only to an AI service you already approved, by your choice, never by default.
Mode C · No-AI review
Designed to keep organizing evidence and the review record while the reviewer writes every determination.
Same principle as Palisade: where a model runs is decided per environment, never as an afterthought.
Verdict · compared
Telos Xacta 360, RegScale and Paramify are systems of record, several with AI features. Verdict does not plan to replace them; it is designed to sit between your evidence and that record.
Against spreadsheet review, the same data control plus mapping, cited reasoning, question threads and caching.
Against general chat AI, evidence stays inside a boundary you choose, tied to a requirement, with a record. OpenAI says business plans are not used for training by default while consumer plans may be unless you opt out; either way evidence leaves your environment.
Against GRC platforms, not a substitute. They manage the record, POA&Ms, SSPs and OSCAL or eMASS exchange, and Xacta.ai and RegScale's AI already assist with statements. Verdict is planned to feed trusted determinations into whichever record you keep.
| Capability | Verdict (planned) | Manual spreadsheet review | Telos Xacta 360 | RegScale | Paramify | DISA STIG Viewer | OpenSCAP | General chat AI |
|---|---|---|---|---|---|---|---|---|
| What it is | Reviewer-assist layer for evidence-to-requirement determinations | Evidence and requirements in workbooks, judged by a person | Commercial GRC and RMF platform | Commercial continuous controls monitoring platform built on OSCAL | Commercial compliance documentation platform | DISA desktop tool for STIG checklists | Open-source SCAP evaluation CLI | General-purpose AI assistant |
| Status | In development; not available | Available | Available | Available | Available | Available | Available | Available |
| Deployment | Planned per environment: local, approved cloud or no-AI | Your machines | On-premises, hosted or SaaS; SaaS is FedRAMP High Authorized | On-prem, cloud or air-gapped, per vendor | Cloud and self-hosted options | Desktop app, Linux and Win64 | Local CLI, Linux and Windows | Vendor-hosted service |
| Maps evidence to requirements | Full, planned: Planned to control, procedure and CCI level | Partial: Entirely by hand | Partial: Xacta.ai drafts implementation statements and validation procedures | See vendor docs | See vendor docs | Partial: STIG rule level, one checklist at a time | Partial: SCAP rule level | None: No built-in mapping |
| Frameworks | Planned: NIST 800-53 (800-53A procedures), NIST 800-171 / CMMC Level 1 to 2, HIPAA Security Rule | Any | RMF and others; see vendor docs | See vendor docs | FedRAMP, CMMC, GovRAMP, FISMA, DoD ATO | DISA STIGs | SCAP content | None built in |
| Proposed determination with reasoning shown | Full, planned: Planned for every determination | Partial: Only if the reviewer writes it | See vendor docs | See vendor docs | See vendor docs | None: Reviewer sets status and comments | Partial: Pass or fail per rule, with HTML report | Partial: Free-form and unstructured |
| Follow-up Q&A tied to each determination | Full, planned: Planned, persistent per determination | None: No | See vendor docs | See vendor docs | See vendor docs | None: No | None: No | Partial: Chat thread, not tied to a determination record |
| Skips re-review of unchanged evidence | Full, planned: Planned fingerprint caching | Partial: Reviewer memory | See vendor docs | See vendor docs | See vendor docs | None: No | None: No | None: No |
| Evidence stays in your environment | Full, planned: Planned local and no-AI modes | Full: Yes | Partial: On-premises option available | Partial: Air-gapped option per vendor | Partial: Self-hosted option | Full: Desktop app | Full: Local CLI | None: Evidence leaves your environment |
| System of record, workflow and approvals | None: Not planned; feeds your record | None: Workbooks only | Full: Workflow, approvals, document generation, POA&Ms | Full: Continuous monitoring, POA&M management | Full: SSP generation, POA&M management | None: No | None: No | None: No |
| eMASS or OSCAL exchange | None: Not planned | None: No | Full: eMASS connection, OSCAL export | Full: Built on OSCAL | Full: OSCAL, eMASS and Word SSPs | None: Not documented | None: Not documented | None: No |
| Human makes the final call | Full, planned: By design, every determination | Full: Yes | Full: Approval workflow | See vendor docs | See vendor docs | Full: Reviewer sets status | Automated results; reviewer interprets | Up to the user |
Verdict column: planned, not shipped. Competitor cells reflect public documentation as of October 2026; "See vendor docs" means not found.
Verdict · early access
Design partners help decide which evidence types, frameworks and model-placement modes come first.
Working with Jacob
Jacob Keith, CISSP, works with businesses from Lompoc across the Central Coast. No tool required; the same rules apply: offline first, your data stays with you, reasoning shown.
Assessments
What matters most, ranked in plain English, with a written plan for whoever does the fixes.
Defense supply chain
Gap analysis and evidence preparation. Keith Systems certifies no one; you arrive knowing where you stand.
Healthcare
Administrative, physical and technical safeguards for medical and dental offices.
Not sure where to start? Try the 2-minute Security Self-Check, browse all services, or read about Jacob.
Sources
Checked October 2026. Palisade facts come from its public repository.
Questions
Yes. It is free and open source under the MIT License, with full source on GitHub. Jacob Keith is a co-maintainer and named copyright holder alongside another maintainer. It is a community project, not a Keith Systems commercial product, and there is no support contract behind it. For help reading and acting on its output, Jacob offers security assessments, CMMC and NIST 800-171 readiness and HIPAA security risk analysis. Keith Systems does not certify anyone. The work helps you find gaps and prepare.
No. The file's Content-Security-Policy sets `connect-src`, `default-src` and every other fetch directive to `'none'`, so the browser refuses any network request. Files leave only as downloads you click. The optional AI prompt package is also just a file. Carrying it to an AI assistant is a deliberate human step, and host names are withheld unless you opt in.
Tenable `.nessus` XML (preferred) or Tenable CSV with the Plugin Output column, SCC XCCDF result `.xml` or the SCC results `.zip`, STIG Viewer `.ckl` and `.cklb` checklists, CVE-keyed threat-intel sheets in `.xlsx`, `.csv` or `.tsv`, your documented hardware and software listings, and prior session `.json` files for drift and trend. Files are recognized by content, not extension.
Not yet. Verdict is a Keith Systems concept in development. It has not shipped and has no users. It is designed to run with a fully local model, with an AI service your organization has already approved, or in a no-AI review mode where a person writes every determination. In every mode, a human makes the final call. To help shape it as a design partner, or to hear when there is something to try, join the early-access list.
A short call about what you have to protect and what to do first. Or take the 2-minute Self-Check for a plain-English score.
Not sure if we're a fit? Call (805) 800-8163 or send a message anyway. If it's not something I do, I'll say so and help you figure out where to look.