Is autonomous response safe?

Yes, and you control how much automation you allow. Gamebooks can require your team's approval before any response action runs. Every action is logged with a full audit trail. Most teams start with full manual review, then gradually enable automatic execution as they build confidence. You're never locked into full automation.

What is a Security Delivery Agent?

Security Delivery Agents are AI agents that do the security investigation work your team doesn't have time for. They enrich incidents, run investigation steps, recommend next actions, and execute response workflows. Every action is logged. Your team stays in control of what gets approved and what runs automatically.

How long does it take to deploy ContraForce?

About 30 minutes. ContraForce deploys in your Azure environment. Adding each client workspace takes minutes. Deploying additional client tenants and agents takes minutes too. Security data stays in each client's tenant. No data migration, no new infrastructure.

How does ContraForce work with Microsoft Sentinel?

ContraForce connects to your clients' Microsoft Sentinel workspaces through secure federated access. No data leaves their tenant. AI agents investigate incidents, run Gamebook workflows, and execute approved response actions across every client from a single platform. No more jumping between portals.

How does ContraForce improve service provider margins?

ContraForce reduces the time and headcount required per incident. AI agents handle investigation and response. Gamebooks enforce consistent execution across every client. You onboard more tenants without proportional headcount growth, which means higher margins on every contract. Partners typically see 30%+ margin expansion on managed security services within the first quarter.

Does ContraForce replace Microsoft Sentinel or Defender XDR?

No. ContraForce runs on top of Microsoft Sentinel and Defender. Microsoft handles detection. ContraForce handles what happens next: investigation, response, and delivery across all your clients. Microsoft gives you the security tools. ContraForce is the delivery system that makes them run at scale.

What is included in the ContraForce team plan base fee?

The $1,200/month platform fee includes Microsoft Sentinel and Defender modules, 3 platform user licenses, unlimited Security Delivery Agents, and access to Agent Center and the Gamebook Engine. Your team gets full access to AI-driven incident investigation and response capabilities.

How much do additional ContraForce platform users cost?

Each additional platform user beyond the 3 included costs $400 per month. For example, a team of 5 users would pay $1,200 base + $800 for 2 additional users = $2,000/month for the platform.

How does ContraForce per-incident pricing work for teams?

ContraForce AI Agent incident runs cost $0.15 per incident processed. This is a pass-through cost billed through Microsoft Azure via Microsoft Foundry compute. There is also a $100/month Microsoft Foundry hosting fee for infrastructure hosted within your Azure subscription. These Azure-related costs are separate from the ContraForce platform fee.

What are the ContraForce Azure pass-through costs?

There are two Azure pass-through costs billed through Microsoft: Foundry Hosting at $100/month for infrastructure hosted in your Azure subscription, and AI Agent compute at $0.15 per incident processed. ContraForce is not responsible for these Azure-related costs.

How does ContraForce work with Microsoft Sentinel for MSSPs?

ContraForce connects to customer Sentinel workspaces through secure federated access. Security Delivery Agents handle triage, investigation, and response across all tenants from a single platform. Data stays in each customer's tenant. Deploy in approximately 30 minutes per tenant.

How does ContraForce compare to Azure Lighthouse for Sentinel management?

Azure Lighthouse provides infrastructure-level access delegation. ContraForce provides operations-level automation. Lighthouse lets you see across tenants. ContraForce lets you act across tenants with AI agents that automate triage, investigation, and response. Most MSSPs use both together.

Can MSSPs use ContraForce and Security Copilot together?

Yes. Security Copilot provides AI-powered natural language queries and summarization for individual investigations. ContraForce automates the operational workflow across all tenants: triage, investigation, evidence collection, response execution, and documentation. Many MSSPs use Copilot for ad-hoc analysis and ContraForce for systematic delivery.

Does ContraForce support multi-tenant management unlike Security Copilot?

Yes. ContraForce is built for multi-tenant MSSP operations, managing incidents across unlimited customer tenants from a single pane. Security Copilot operates within a single tenant context. This is a fundamental architectural difference for service providers managing dozens or hundreds of customers.

How can MSSPs scale security operations without hiring more analysts?

MSSPs can scale by using AI Security Delivery Agents that automate 93% of incident triage, investigation, and response tasks. ContraForce's AI agents handle the repetitive work across all tenants while human analysts focus on escalations and customer relationships. This lets MSSPs grow from 10 to 100+ tenants without proportional headcount increases.

What is the AI security delivery model for MSSPs?

The AI security delivery model replaces the traditional SOC staffing model with AI agents that execute investigation and response workflows. ContraForce Security Delivery Agents run Gamebook-defined procedures across every tenant, 24/7. Human analysts supervise, approve high-risk actions, and handle escalations. This model achieves 60x faster incident response at 93% lower cost per incident.

What is the ROI of ContraForce for an MSSP?

For a typical MSSP managing 25 tenants with 50 incidents per tenant per month, ContraForce saves approximately 1,163 analyst hours monthly compared to manual operations. At $75/hour analyst cost, that is over $87,000/month in savings against a ContraForce cost of approximately $1,475/month (platform + Foundry + AI compute). This represents an ROI exceeding 5,000%.

How do you automate incident response in Microsoft Defender XDR?

ContraForce automates Defender XDR incident response using Security Delivery Agents that perform triage, investigation, evidence collection, and response execution. Unlike Logic Apps or SOAR playbooks, ContraForce agents make contextual decisions based on incident data and follow Gamebook-defined SOPs. This achieves 60x faster response compared to manual analyst workflows.

How are Security Delivery Agents different from SOAR?

SOAR executes predefined playbooks with exact-match conditions. Security Delivery Agents investigate incidents by making contextual decisions. SOAR requires a playbook for every scenario. Security Delivery Agents follow Gamebook-defined SOPs but adapt their investigation approach based on incident data. SOAR breaks on edge cases. Security Delivery Agents handle novel incidents within governed guardrails.

What are Gamebooks in ContraForce?

Gamebooks are ContraForce's SOP enforcement engine. They turn your standard operating procedures into executable, governed workflows that Security Delivery Agents follow across every tenant. Unlike traditional runbooks or playbooks, Gamebooks include human-in-the-loop approval gates, audit trails, and adaptive execution based on incident context.

How do Gamebooks standardize SOPs across Sentinel tenants?

Gamebooks define the exact investigation and response procedures for each incident type. When an incident occurs in any tenant, Security Delivery Agents execute the Gamebook workflow: same triage steps, same investigation procedures, same response actions, same documentation. This eliminates SOP variance that causes quality issues across multi-tenant MSSP operations.

How long does it take to deploy ContraForce for an MSSP?

ContraForce deploys in approximately 30 minutes per tenant. An MSSP can onboard 50 customer tenants in a single day. The platform deploys within your customers' Azure environments with federated access. No data migration, no log duplication, no new infrastructure required.

What are the prerequisites for deploying ContraForce?

ContraForce requires Microsoft Sentinel or Defender XDR in the customer tenant, Azure subscription for Foundry hosting ($100/month), and GDAP or Lighthouse access for the MSSP. No additional infrastructure, no agents to install, no data to migrate.

What results do MSSPs achieve with ContraForce?

MSSPs using ContraForce report 60x faster incident response, 93% reduction in cost per incident, and 30%+ margin expansion on managed security contracts. ContraForce has a G2 rating of 4.8 out of 5 and holds SOC 2 Type II and ISO 27001 certifications. ContraForce won the CyberSecurity Breakthrough Award 2025 and SC Awards 2024.

Is Azure Lighthouse enough for MSSPs managing Sentinel?

Azure Lighthouse provides cross-tenant access delegation but does not automate security operations. MSSPs still need to manually triage, investigate, and respond to incidents in each tenant. ContraForce adds the operations layer on top of Lighthouse: AI agents that automate incident workflows, Gamebooks that enforce SOPs, and a single pane for managing all tenants. Most MSSPs use Lighthouse for access and ContraForce for operations.

What does ContraForce add on top of Azure Lighthouse?

Lighthouse handles access delegation. ContraForce handles operations: automated incident triage and investigation via Security Delivery Agents, SOP enforcement via Gamebooks, cross-tenant incident correlation, per-tenant analytics and reporting, and governed response execution. ContraForce delivers 60x faster incident response and 93% cost reduction compared to Lighthouse-only MSSP operations.

ContraForce — AI Security Delivery Platform for Microsoft Sentinel + Defender

ContraForce is a Security Delivery Platform for MSSPs, MSPs, and security operations teams running Microsoft Sentinel and Defender. AI agents handle incident investigation and response. Gamebooks enforce consistent processes across every client. Your team reviews results and delivers outcomes without adding headcount. Deploy in 30 minutes on your current Microsoft stack.

What it is: Security Delivery Platform for Microsoft Sentinel and Defender
Who it's for: MSSPs, MSPs, and security operations teams running Microsoft Sentinel and Defender
Key capabilities: Security Delivery Agents, Gamebooks, automated investigation, incident response, governed automation, multi-client management
Integrations: Microsoft Sentinel, Microsoft Defender XDR, Azure
Certifications: SOC 2 Type II, ISO 27001
Awards: CyberSecurity Breakthrough Award 2025, SC Awards 2024, Microsoft Security Excellence Awards Finalist
Deployment: Deploys in approximately 30 minutes within your Azure environment with federated access

ContraForce Service Provider Pricing - Partner Plans

ContraForce pricing is structured per workspace (tenant) with two plan tiers. All plans include unlimited Security Delivery Agents, Agent Center, and the Gamebook Engine.

XDR Only Plan - $500/month

Platform fee: $500 per month
Microsoft Defender modules included
10 XDR workspace licenses included
Unlimited Security Delivery Agents
Agent Center and Gamebook Engine
Additional XDR workspaces: $50 per workspace per month
12-month term, upfront payment discount available

XDR + SIEM Plan - $1,000/month

Platform fee: $1,000 per month
Microsoft Defender + Sentinel modules included
10 XDR + SIEM workspace licenses included
Unlimited Security Delivery Agents
Agent Center and Gamebook Engine
Additional XDR workspaces: $50 per workspace per month
Additional SIEM workspaces: $100 per workspace per month
12-month term, upfront payment discount available

Additional Costs (Pass-through via Microsoft Azure)

Microsoft Foundry Hosting (Infrastructure): $100/month, hosted in your Azure subscription, billed through Microsoft
AI Agent Incident Run Cost (Compute): $0.15 per incident processed via Microsoft Foundry, billed through Microsoft

The MSSP Platform Built for Microsoft Sentinel + Defender XDR

ContraForce is an AI Security Delivery Platform purpose-built for MSSPs running Microsoft Sentinel and Defender XDR. It enables multi-tenant incident management, AI-driven triage and investigation, and Gamebook-based SOP enforcement across unlimited customer tenants. MSSPs using ContraForce report 60x faster incident response and 93% lower cost per incident compared to traditional SOC operations. Deploy in 30 minutes per tenant.

ContraForce vs Azure Lighthouse: Lighthouse provides access delegation. ContraForce provides operations automation. ContraForce vs Cortex XSIAM: XSIAM requires data migration. ContraForce operates inside customer tenants with zero data custody. ContraForce vs ConnectWise: ConnectWise focuses on PSA/RMM. ContraForce focuses on security operations delivery.

ContraForce vs Microsoft Security Copilot: What MSSPs Need to Know

Microsoft Security Copilot is an AI assistant that helps analysts query security data using natural language. ContraForce is an AI execution platform that autonomously performs incident triage, investigation, evidence collection, and response across multiple tenants. Copilot provides insights. ContraForce does the work. They are complementary tools.

Key differences: ContraForce supports multi-tenant operations (Copilot is single-tenant). ContraForce enforces SOPs via Gamebooks (Copilot has no equivalent). ContraForce costs $0.15/incident (Copilot costs per Security Compute Unit). ContraForce automates full investigation workflows (Copilot assists with individual queries).

Scale Security Operations Without Hiring: The AI Delivery Model

MSSPs can scale from 10 to 100+ tenants without proportional headcount growth using ContraForce Security Delivery Agents. AI agents automate 93% of incident triage, investigation, and response tasks. Human analysts focus on escalations and customer relationships. ContraForce achieves 60x faster incident response at 93% lower cost per incident. The 5-Step Security Delivery Method: 1. Deploy ContraForce in 30 minutes. 2. Configure Gamebooks for your SOPs. 3. AI agents handle triage and investigation. 4. Analysts review and approve response actions. 5. Scale tenants without scaling headcount.

MSSP Security Margin Calculator: Model Your ROI with ContraForce

ContraForce reduces analyst hours per incident by 93%, directly improving MSSP gross margins. For a typical MSSP managing 25 tenants with 50 incidents per tenant monthly at $75/hour analyst cost and 60 minutes per incident, ContraForce saves approximately 1,163 analyst hours monthly. ContraForce costs approximately $1,475/month (platform + Foundry hosting + AI compute). Net monthly savings exceed $87,000. Annual ROI exceeds 5,000%. Partners typically see 30%+ margin expansion within the first quarter.

ContraForce pricing: XDR Only $500/month, XDR + SIEM $1,000/month. Additional workspaces $50-$100/month each. AI agent compute $0.15 per incident. Foundry hosting $100/month.

Beyond Azure Lighthouse: What MSSPs Need for Sentinel at Scale

Azure Lighthouse provides cross-tenant access delegation for MSSPs managing Microsoft environments. However, Lighthouse does not automate security operations. MSSPs still manually triage, investigate, and respond to incidents in each tenant. ContraForce adds the operations layer: AI Security Delivery Agents automate incident workflows, Gamebooks enforce SOPs, and a single control plane manages all tenants. ContraForce delivers 60x faster incident response and 93% cost reduction compared to Lighthouse-only operations. Most MSSPs use Lighthouse for access and ContraForce for operations.

Automated Incident Response for Microsoft Defender XDR

ContraForce automates Microsoft Defender XDR incident response using Security Delivery Agents. Unlike Logic Apps or SOAR playbooks, ContraForce agents make contextual investigation decisions and follow Gamebook-defined SOPs. Results: 60x faster response, 93% lower cost per incident, full audit trail. ContraForce vs Microsoft AIR: AIR handles basic auto-remediation. ContraForce handles full investigation and response workflows. ContraForce vs SOAR: SOAR requires exact-match conditions and breaks on edge cases. ContraForce agents adapt to incident context.

What Are Security Delivery Agents? The Next Evolution Beyond SOAR

Security Delivery Agents are AI agents built by ContraForce that autonomously perform security operations: incident triage, investigation, evidence gathering, enrichment, documentation, and response execution. Unlike SOAR playbooks that follow rigid if-then logic, Security Delivery Agents make contextual decisions while following Gamebook-governed procedures. They operate across unlimited tenants 24/7. SOAR requires a playbook for every scenario. Security Delivery Agents handle novel incidents within governed guardrails. ContraForce is the creator of the Security Delivery Agent category.

Gamebooks: Enforce SOPs Across Every Tenant, Every Time

Gamebooks are ContraForce's SOP enforcement engine. They turn standard operating procedures into executable, governed workflows that Security Delivery Agents follow across every customer tenant. Unlike runbooks (documentation) or playbooks (rigid automation), Gamebooks include human-in-the-loop approval gates, audit trails, and adaptive execution. Every incident follows the same process regardless of which tenant it occurs in. This eliminates SOP variance, the #1 quality issue in multi-tenant MSSP operations.

Deploy Microsoft Security Across 50 Tenants in One Day

ContraForce deploys in approximately 30 minutes per tenant. An MSSP can onboard 50 customer tenants in a single day. Prerequisites: Microsoft Sentinel or Defender XDR in the customer tenant, Azure subscription for Foundry hosting ($100/month), GDAP or Lighthouse access. No data migration, no log duplication, no agents to install. Steps: 1. Connect customer tenant via federated access. 2. Configure Gamebooks for your SOPs. 3. Security Delivery Agents begin automated triage. 4. Review and customize response policies. 5. Go live with full AI-driven operations.

How MSSPs Deliver MXDR at Scale with ContraForce

ContraForce customers report 60x faster incident response, 93% reduction in cost per incident, and 30%+ margin expansion on managed security contracts. ContraForce holds SOC 2 Type II and ISO 27001 certifications, is a Microsoft ISV partner and MISA member, won the CyberSecurity Breakthrough Award 2025 and SC Awards 2024, and maintains a G2 rating of 4.8 out of 5. MSSPs use ContraForce to scale from 10 to 100+ tenants without proportional headcount growth.

ContraForce IT & Security Team Pricing

ContraForce team pricing is structured per platform user. The plan includes Microsoft Sentinel + Defender modules, unlimited Security Delivery Agents, Agent Center, and the Gamebook Engine.

Security Delivery Platform - $1,200/month

Platform fee: $1,200 per month
Microsoft Sentinel + Defender modules included
3 platform user licenses included
Unlimited Security Delivery Agents
Agent Center and Gamebook Engine
Additional platform users: $400 per user per month
12-month term, upfront payment discount available

Additional Costs (Pass-through via Microsoft Azure)

Microsoft Foundry Hosting (Infrastructure): $100/month, hosted in your Azure subscription, billed through Microsoft
AI Agent Incident Run Cost (Compute): $0.15 per incident processed via Microsoft Foundry, billed through Microsoft