Security delivery for MSPs and MSSPs
Reviewed by ContraForce team
Own your security service.
Not the headcount.
More clients used to mean more analysts.
Security Delivery Agents work every incident for every customer
on the Microsoft Security platform, overnight included:
triage, investigation, response, tuning, ticket, report.
You decide what runs on its own and what waits for your approval.
Microsoft Security ISV of the Year, 3x Recognized
Start a free trial See pricing
The tools detect. Someone still has to deliver.
Every new client brings more alerts, more tenants, and more tickets. Attackers now use AI to move faster. Your team doesn’t grow at the same rate, and the work doesn’t stop at 5 p.m.
The economics
Every client costs the same. Your price keeps falling.
Human-led delivery costs about the same per tenant on client one hundred as on client one. Buyers expect prices to fall as you grow. That gap is where your margin goes.
The hours
Attacks land at 3 a.m. Your team doesn’t.
Incidents don’t keep business hours. Most teams cover the night with an on-call rotation that wakes someone up for every alert, or with nobody watching the queue at all.
The quality
Whoever picks up the alert decides how it’s handled.
Your most experienced person handles an incident one way. Whoever is on call handles it another. No enforcement, and no audit trail to show a client when things go wrong.
Here’s what happens when an incident hits.
Follow one incident from detection to client report, across every customer you protect.
It starts with one console.
Every customer you protect, every tool they run, every action your team takes. One ContraForce console sits at the center.
Your team signs in once.
One identity with governed access to every customer. No jump boxes, no tenant switching, no browser tab per client.
Every customer connected.
Connect every customer workspace, wherever it lives. Each stays isolated in its own region, and its logs stay in its own tenant.
Every tool, one queue.
Connect the XDR and SIEM tools your customers already run. Every incident lands in one normalized timeline, so every tenant works the same way.
Agents take the first pass.
Security Delivery Agents triage and investigate each new incident, follow your Gamebook™ workflows, and return a verdict with the evidence in minutes.
Response, inside your limits.
Some incidents need more than a verdict. Agents close what the evidence supports and recommend the response for the rest. Your approval rules decide what runs on its own.
Every step, in order.
Revoke the sessions, scan the endpoint, lock the account. Once approved, each action runs in sequence on the right tenant and lands in the audit trail.
Ticketed. Reported. Done.
The ticket carries the evidence into your PSA. The client report shows what happened and what your team did about it.
Change once. Every tenant follows.
Update a setting, choose Update all, and the change rolls out across the fleet. No scripts, no drift, no tenant left behind.
Run every customer from one system, from first incident to final report.
Connect the workspaces, work the incidents, govern the actions,
and see what each one costs.
Multi-tenant control plane
Connect every customer tenant through federated access and run them all from one pane. Their logs stay in their own tenant, with nothing copied out.
- Federated access across customer tenants
- No duplicated customer log store
Security Delivery Agents
Agents run the delivery loop end to end: triage, investigation, response, tuning, ticket, report. Your team reviews outcomes instead of producing them.
- Six-stage security delivery loop
- Evidence-linked investigations
Govern agent automation
Your standard operating procedures (SOPs) become executable workflows with approval gates at every level. Every action an agent takes lands in the audit trail.
- Approval gates on every consequential action
- Full attribution per decision
Agent cost management
Track investigations, token usage, and spend per workspace in one place. Forecast the cycle before it closes and set spend controls, so delivery cost never surprises you.
- Spend forecast before the cycle closes
- Workspace-level cost controls
Three jobs your team
stops doing by hand.
Fleet management, detection tuning, and investigations on your schedule. One platform, with your team in control.
1 Agentic fleet management
Manage the fleet, not the tenant.
Every workspace you run sits in one console. Onboard a tenant, set its agent mode, push one policy across all of them, and see where each one stands. The delivery work stops multiplying with the tenant count.
- One console, every workspace
- Per tenant autonomy level
2 Agentic detection tuning
Tuning at your customers’ pace.
Agents watch which detections fire and which resolve as noise, then draft the rule change with its evidence. Tuning moves at the speed of the evidence, not the backlog. Nothing ships without your approval.
- Noise scored per rule
- Change note drafted for you
3 Agent Shifts
Agents take the night shift.
Choose when Security Delivery Agents investigate on their own. Most teams start with nights and weekends. Your team wakes up to verdicts, not a backlog, and anyone can start an investigation by day.
- Nights and weekends covered
- Your hours, your timezone
Connect one workspace. See what happens on the first investigation.
What teams use ContraForce to deliver.
Launch new security services in days.
Stand up managed detection and response offerings in days, not quarters. The platform replaces the SOC build-out, not the analyst. Capture the security revenue your team has been walking away from.
Onboard a new client this week. Not next quarter.
Connect the workspace, set its agent mode, and push the policy your fleet already runs. The new client starts from your standard, with the same approvals and the same reporting, not from scratch.
Start with the Defender your clients already own.
Most of your clients already pay for Defender in Business Premium. Few ever see it worked. Turn the security they bought into a service they can see, with no migration. Add a SIEM when a customer needs one.
Scale coverage without scaling cost.
A monthly plan plus a flat rate per incident a Security Delivery Agent processes. No per-user or per-endpoint math. The economics work the same on client one hundred as they do on client one.
ContraForce powers MSPs globally
Trusted by security delivery teams securing every size business.
“ContraForce is the first platform that actually runs the work instead of just showing it to us. Our agents triage and investigate at a scale and speed no human team could match, our analysts spend their time on the decisions that matter, and the quality holds across every customer we protect. This is how Microsoft-native security gets delivered now, and it has changed what our business can take on.”
Sam Bourgeois
CISO, DYOPATH
“ContraForce is a platform of platforms when looking for a single control plane, centralized automation and AI. It becomes the MSSP tool of choice when considering value multipliers for our SOC service offering, to aid our people, to aid our customers and ultimately to support our margins.”
Darren Humphries
CISO, Acora
“So far the results have been fantastic. The amount of detail it provides is really good. We can take that data and share it with our customers, showing them what happened, and it just wows them.”
Scott Christal
Senior Solutions Architect, GCS Technologies
“Our mean time to acknowledge is now four minutes, down from upwards of over an hour.”
Cyber Security Engineer, Littlefish
“We evaluated several security tools against each other. ContraForce came out ahead on the two things our clients care most about: how quickly an incident gets investigated and resolved, and how well they are protected while it happens. It is an integral part of how we keep them protected.”
Jake Hensley
Founder and CEO, RYEHAUS
And many more…
- Acora
- Zirilio
- GCS Technologies
- DYOPATH
- Abra
- Littlefish Group
- RYEHAUS
New security operating model for the AI threat frontier.
Agentic Security Delivery is a different way to run security operations.
Start with the concepts.
What is Agentic Security Delivery?
An operating model where Security Delivery Agents run the work of security, governed by humans, across every environment you protect.
What is a Security Delivery Agent?
A worker that investigates, decides within your guardrails, executes, and documents end to end.
What is the Security Delivery Gap?
The distance between the security an organization has bought and the security it actually receives.
Frequently asked questions.
What is ContraForce?
ContraForce is the Agentic Security Delivery Platform for MSSPs, MSPs, and security operations teams. ContraForce Security Delivery Agents run the entire delivery loop on the Microsoft Security platform: triage, investigation, response, tuning, ticket, report. Gamebook™ workflows enforce the same procedure across every client, so your team reviews outcomes instead of producing them.
Who is ContraForce for?
ContraForce is built for MSSPs and MSPs delivering security across their customers' XDR and SIEM tools, including providers launching a managed security service without first building a SOC. ContraForce bills you, the provider, never your customers, so you keep the customer relationship and set your own price. In-house security operations teams use it too.
Do I need security analysts to use ContraForce?
No. Many providers start ContraForce without a security analyst on staff. ContraForce Security Delivery Agents do the triage and investigation on every incident, overnight included. Your team reviews the verdict in the ticket and approves the response, and you decide which actions wait for a human.
How does ContraForce work?
ContraForce connects to each customer's security tools and runs every customer from one multitenant control plane. When an incident lands, a Security Delivery Agent triages and investigates it, takes or recommends a response, tunes the detection, updates the ticket, and writes the report under your Gamebook workflows. Your team keeps the judgment calls and approves anything reserved for a human.
What security tools does ContraForce work with?
ContraForce works on top of your existing XDR and SIEM tools instead of replacing them: your tools detect threats, and ContraForce handles investigation, response, and reporting. You don't need a SIEM to start; begin with your XDR and add a SIEM when a customer needs it. Ticketing integrations with ConnectWise, Halo, and ServiceNow are included on every plan, Starter included, with ConnectWise and Halo connected through webhooks.
Will ContraForce act in my customers' environments without my approval?
ContraForce takes response actions only where you allow them. Security Delivery Agents can start by investigating and recommending, with your team approving every action. You set approval gates per customer workspace, and an attributable audit trail records every action and approval. When the verdicts hold up on your own incidents, expand autonomy one Gamebook workflow at a time.
What does ContraForce do with my customers' data?
ContraForce leaves your customers' logs and telemetry in their own SIEM or XDR and queries them in place. It stores the incident records, verdicts, and evidence its agents produce in a United States, United Kingdom, or European Union deployment. ContraForce does not train or fine-tune AI models on customer data and is independently audited to SOC 2 Type II.
How does ContraForce pricing work?
ContraForce pricing is a monthly plan plus pay-as-you-go investigations, starting at $249 per month. ContraForce hosts and operates the platform, so there is no infrastructure to deploy. Plans are month-to-month and annual billing is discounted. No bundles, no included investigations, and no overage tiers.
Does ContraForce have a free trial?
Yes. ContraForce offers a free trial: 14 days free, with no workspace or detection module limit and unlimited Security Delivery Agents. You start it yourself from the ContraForce signup page, and no demo or sales call is required first.
Connect one workspace.
See what happens on the first alert.
Security Delivery Agents start on the first incident that lands. Start in Manual mode and review every verdict before anything runs.