The MSP and MSSP platform for Microsoft Defender XDR and Sentinel
Reviewed by ContraForce team
Run security for hundreds of organizations.
With the team you have.
ContraForce gives service providers the Security Delivery Agents, enforced procedures, and fleet-wide control plane to deliver managed security across every customer environment, profitably, from day one.
Your customers expect
managed security.
Delivering it is the hard part.
Every customer you serve is being told they need managed detection and response. They're asking you for it - and they'd rather buy it from the provider they already trust.
Most providers see two paths. Outsource to a white-label SOC, and someone else runs the delivery: their procedures, their analysts, their black box - and a slice of your margin and your customer relationship goes with it. Or hire and build: new roles, new risk, and months of cost before the first dollar of security revenue.
There's a third path.
From alerts to outcomes
in three moves
AI that does the work, not just summarizes it
Security Delivery Agents handle the tasks that consume 80% of analyst time: triage, investigation, evidence gathering, enrichment, documentation, and ticket updates. They run against your procedures, across every customer environment, 24/7.
Your procedures. Actually enforced.
Gamebooks turn your standard operating procedures into executable, governed workflows. Every incident follows the same process, approval thresholds gate high-risk actions with human-in-the-loop review, and every decision lands in the audit trail.
One control plane. Every environment.
Manage every customer from a single operations layer. ContraForce runs detection and response across your whole fleet, routes incidents to your PSA and ticketing systems, and keeps delivery consistent as the book grows.
Built for the service provider
business model
Launch fast, not someday
Stand up managed detection and response services on the security stack your customers already run. No new agents. No data duplication. No six-month implementation. You're delivering in days.
Keep the economics
Flat per-client pricing, and Security Delivery Agents that cut the analyst hours behind every incident. Your cost per incident drops as the fleet grows - the margin math works at client one hundred the same way it works at client one.
Own the customer relationship
Unlike MDR vendors, ContraForce doesn't sit between you and your customer. You run the delivery. You set the procedures. You keep the relationship and the recurring revenue.
Results that change
the business case
6
Stages in the complete delivery loop
Triage through customer-ready report.
0
Duplicated customer log stores
Federated access keeps security data in the customer environment.
1
Multitenant control plane
Operate customer environments from one governed workspace.
1
Attributable audit trail
Evidence, decisions, approvals, and actions stay reviewable.
Their data never leaves.
Your standard never slips.
Adding security services
Launching your first security offering? Deliver managed detection and response without a SOC build-out. Agents do the analyst work, and Gamebooks give you enforced procedures from day one.
Scaling an existing SOC
Running hundreds of customer environments? One control plane enforces one standard across all of them, so delivery quality holds while the team stays the same size.
Operating at national scale
Thousands of clients, audit-ready governance, and data residency by default. ContraForce operates inside each customer environment, so logs stay in-region and every incident produces exportable evidence.
Works with your stack.
Runs on theirs.
Runs natively on the stack your customers already own. ContraForce connects to the PSA and ticketing tools your delivery team already uses, so incidents close the loop without another swivel chair.
- Microsoft Sentinel
- Microsoft Defender
- SentinelOne
- CrowdStrike
- Microsoft Entra ID
- ConnectWise
- Autotask
- ServiceNow
Three paths.
One that actually works.
| Build your own SOC | Resell an MDR | Deliver with ContraForce | |
|---|---|---|---|
| Time to launch | 6–12 months | 4–8 weeks | Days |
| Who owns the customer | You | The vendor, in practice | You |
| Margin model | Headcount-dependent | Vendor-controlled | Provider-controlled |
| Control of procedures | Manual enforcement | Their procedures, not yours | Enforced by Gamebooks |
| Data custody | Yours to secure | Third-party data lake | Stays in the customer environment |
Weighing a specific vendor? Read ContraForce vs Huntress, ContraForce vs Dropzone AI, and ContraForce vs Torq, or browse every platform comparison.
Live in days,
not quarters
Connect
Link ContraForce to each customer environment through federated access. No new agents on endpoints, no data duplication - nothing leaves the customer environment.
Configure
Load your standard operating procedures into Gamebooks. Set approval thresholds, escalation paths, and environment-specific rules.
Activate
Security Delivery Agents begin triaging, investigating, and documenting incidents across every connected environment, 24/7.
Approve
High-risk actions wait for your team’s human-in-the-loop sign-off. Everything else runs autonomously against your procedures.
Go live
Add the rest of the fleet to the control plane. Same procedures. Same quality. Growing margin.
Most providers are fully operational in under a week.
Keep Exploring
Build your business case
Pricing from $249/mo
Published monthly plans plus flat per-incident processing. Model costs against your workspace and incident volume.
Delivery margin calculator
Model the analyst hours, cost per incident, and margin lift across your customer book.
What is Agentic Security Delivery?
The delivery model behind the platform: Security Delivery Agents, enforced procedures, and a fleet-wide control plane.
What is the Security Delivery Gap?
Why demand for managed security keeps outrunning the teams available to deliver it.
Frequently asked questions.
Do my customers need to change anything in their existing setup?
Customers need a security baseline on the stack they already run. ContraForce operates as an overlay on whichever endpoint detection platform is in place - no new agents, no data duplication, and no disruption to their existing setup.
Do I need security analysts on staff to use ContraForce?
No. You don't need a SOC team at all. Security Delivery Agents autonomously handle the full incident response lifecycle: triage, investigation, enrichment, and response. For actions that require permissions on customer assets (account disablement, device isolation, etc.), your team can approve them or let the agents run autonomously.
Does ContraForce replace our analysts?
No. It replaces the repetitive work your analysts shouldn't be doing. Triage, basic investigation, documentation, and ticket routing are handled by Security Delivery Agents. Your analysts focus on complex investigations, customer relationships, and strategic decisions.
How does ContraForce handle delivery across many customer environments?
ContraForce is purpose-built for multi-environment delivery. The control plane gives your team visibility and operational control across every customer environment from a single interface. Procedures can be standardized globally or customized per environment.
How is this different from delegated-access tools like GDAP and Lighthouse?
Delegated access solves who can see what, and it stops there. GDAP and Lighthouse give you multi-environment visibility and access delegation. ContraForce automates the work on top: triage, investigation, response, procedure enforcement, and ticketing. Access tools show what is happening across your environments; ContraForce does the security delivery work autonomously.
Is there a risk to our customers' data?
ContraForce uses a federated access model: it operates inside each customer environment, in their region. Logs and telemetry never leave the customer environment. No log duplication. No third-party data custody. This reduces your compliance surface and removes the data residency objections that slow procurement.
Can we run this under our own brand?
Yes. The control plane and reporting layer support private-label deployments. Your customers see your service, not ours.
What does onboarding look like?
Most providers are operational within a week. Connect customer environments, configure Gamebooks, activate agents. ContraForce provides onboarding support to ensure your team is delivering fast.
Your customers. Your brand.
Agents on delivery.
See how ContraForce deploys on the stack your customers already run. No rip-and-replace. No SOC build-out. Validate delivery in your own environment.