Skip to content

MSSP and service provider

Serve more clients without hiring proportionally.

Your margin is analyst hours. Every hour spent on enrichment, duplicate alerts, and hand-built reporting is margin you do not keep.

Click through Alert Navigator in the Demo Center →

What changes

What your week looks like

Left is the week you have. Right is the same week on the platform. Nothing else on this page matters more than whether the left column is recognisable.

  1. Each client's reporting is assembled by hand, every month.

    Scheduled deliverables per client, generated on cadence, held for review, then distributed, with the delivery logged.

  2. Analyst time goes to triage that does not differentiate your service.

    Classification, grouping and enrichment are handled by the agents, so analyst hours go to decisions that need judgement.

  3. Onboarding a client means weeks of integration work.

    Connectors are provisioned per tenant from your own key vault, and one configured connector serves every agent that needs it.

  4. Client posture questions need a person to answer them.

    Per-client posture is a surface rather than a request, and one tenant's data is never queried in another tenant's context.

Access

What you own, and what you can reach.

The platform has three roles, not six. This is the one you would hold, enforced at the route on the client and again on the server rather than hidden in the interface.

Platform role

Admin

What it opens
The Management Portal and per-client connector health, user and invitation management, and every subscribed agent.
What it does not
Nothing above it. Analyst and Viewer are what you hand out: Viewer is read-only, which is usually what a client contact should hold.

The measure

The numbers you would be judged on.

Published targets and platform behaviour, not projections. Where one of these is a target rather than an achievement, it says so.

  • Per tenant

    Isolation

    One tenant's data is never queried in another tenant's context.

  • Your vault

    Credentials

    Connector secrets stay in your key vault, never in our database.

  • 3

    Roles to hand out

    Admin, Analyst and Viewer, enforced at the route rather than in the interface.

  • On cadence

    Reporting

    Generated, reviewed, distributed and logged, per client.

Your workspaces

What you would actually open.

You can turn one on and add the others later. A connector configured for one is available to the rest.

Questions

The things people ask first.

  • How is one client's data kept out of another's?

    Every query runs in a tenant context and one tenant's data is never queried in another's. Connectors are provisioned per tenant from your own key vault at deployment, so the isolation is in the credentials as well as in the queries.

  • What does onboarding a client actually involve?

    Connecting that client's sources and clearing each agent's context-readiness threshold. An agent will not enable until its readiness clears its own gate, which is deliberate: the agents are only as good as the context behind them.

  • Can a client see their own posture without asking us?

    Give them Viewer. It is read-only access to dashboards and reports with no ability to act, which is the role built for stakeholders who need visibility rather than control.

  • Where does the margin actually come from?

    The hours that go into enrichment, deduplication and hand-built reporting. Classification and grouping remove volume before an analyst reads anything, and the deliverables generate on cadence rather than being assembled per client per month.

The rest of the team

You are almost certainly not the only person who has to agree to this.