The Next Battleground for MSSPs

A new MSSP customer usually looks profitable on the day the contract is signed, mostly because the delivery team hasn't seen the environment yet. Nobody knows about the odd identity setup or the log source that shows up half-empty, so for a few weeks the spreadsheet gets to be right.

Then the first real escalation goes out. The customer doesn't care about the forty million events you processed last month, because a decade of alert-heavy security programs has taught buyers to hear volume as noise. They remember the small number of cases where someone on their side had to make a decision, and whether your escalation gave them enough to make it.

Getting that right is harder than sales decks admit. An alert often carries enough information to open a case but not nearly enough to understand one, which leaves the analyst to work out who the user is, whether the behaviour is normal for them, and where the rest of the story is sitting in other consoles. Good analysts will get there. You pay for every minute it takes.

Knowledge Nobody Wrote Down

Spend a day with a mature SOC team and you'll see how much of the service lives in people's heads. Someone knows that a certain customer's identity configuration throws alerts that look alarming and never are, and someone else knows that an alert which normally closes in two minutes needs a much harder look on one particular account because of what that customer runs there.

Experienced teams are good because they carry all of this around, but it also hides how much of a supposedly standardised service still depends on manual effort.

Ten extra minutes on a single case disappears without anyone noticing. Across thousands of investigations a month, it becomes a real cost measured in analyst hours, and it tends to land on your most expensive people, since they're the only ones who know where to look. Revenue keeps climbing while labour climbs right behind it, close enough that growth can feel like treading water.

I've watched providers hit a wall where the platform could have taken on another customer tomorrow and the team simply couldn't. Ingestion was never the constraint. Every new environment brought its own quirks and its own investigative load, and all of it landed on people, so a service sold like a product ended up being delivered like consulting.

As customer count grows, the healthiest service model is one where the same team can absorb more of that work without adding people at the same pace. More of the contract value stays available for experienced analysts, stronger services, and the parts of the relationship customers are actually willing to pay for.

Where Margin Lives

If one provider needs ninety minutes to turn an alert into a conclusion a customer can act on and another gets there in thirty, the gap on any single case is an hour. At MSSP scale it separates two very different businesses, and you'll feel it most when sales asks how many new logos the team can absorb this quarter.

A lot of that gap comes down to when context arrives. Threat intelligence is most useful in the middle of an investigation, when learning that an IP belongs to an active campaign can change how an analyst reads what's in front of them. If getting that answer means opening another tab and starting a small research project, it shows up after the decision has already been made.

When the evidence and reasoning are captured in the case while the work is happening, nobody has to rebuild the story three weeks later for a quarterly review, and you don't pay twice for an investigation you already delivered.

We built Securonix Unified Defense SIEM around this problem, bringing detection data and curated threat intelligence into the investigation workflow so the context is sitting in the case while the analyst is working it. Saving a few minutes per investigation sounds modest until you run it across a managed customer base, where it decides how many cases your team can carry before you're forced to hire.

Customers notice this, and they bring it up at renewal. An escalation that already contains the context shows them you understand their environment. When a case was harder than it should have been because their visibility was weak, you can point to the exact gap and explain what fixing it would get them, and that conversation usually ends in expansion rather than churn.

Let Your Best People Do Their Best Work

Closure rates stay popular because they're easy to count, but they say almost nothing about how the time was spent. A team can post excellent throughput while its most experienced analysts spend their days collecting routine evidence and cleaning up other people's half-finished investigations.

Senior analysts justify their salaries when the evidence is ambiguous, and someone has to make a call. They're the ones who notice that a string of boring events adds up to something alarming, or that a low-severity alert matters because of what this customer does. Every hour they spend gathering evidence is an hour of that judgment you don't get.

Newer analysts face a long ramp because every account works differently, and when the context lives in team memory, your veterans end up doing the onboarding on top of their own caseload. That gets more expensive with every customer you add.

AI can take real work off the pile, provided analysts can see what it's working from. A summary grounded in the actual evidence can spare someone from reading forty events to learn what has already happened. The analyst still must be able to check how a recommendation was reached, because you're the one accountable for whatever reaches the customer.

Weeks after an incident, a customer may want to know why you recommend isolating a host during their busiest week of the year. If the reasoning is in the case record, anyone on your team can answer. If it was in the head of whoever was on shift that night, you'd better hope they still work there.

Customer-specific rules need to be just as visible. Isolating an endpoint might be routine for one customer and require a phone call for another because that machine runs something the business can't afford to lose, and analysts need to see that while they're working, not find out after they've already acted.

When the case carries this context, newer analysts can safely take on more of the load and senior people stay free for the investigations where their experience changes the outcome. The business can then grow its customer count faster than its headcount, which is how an MSSP gets more profitable as it gets bigger.

What Customers Really Buy

MSSP proposals promise roughly the same things, and customers stopped believing claims they can't see for themselves a long time ago.

They can see an investigation. When a case arrives with most of the work already done, and they can make a decision in five minutes instead of spending an afternoon finishing your analysis, they decide what you're worth. No competitor can match that with a better slide.

Over the next few years, the providers that grow will be ones whose teams can keep adding customers without hiring at the same pace, and who put the savings into experienced analysts and the services customers will pay more for.