ContraForce is a Security Delivery Platform for MSSPs, MSPs, and security operations teams running Microsoft Sentinel and Defender. Security Delivery Agents handle incident investigation and response. Gamebooks enforce consistent processes across every client. Your team reviews results and delivers outcomes without adding headcount. Connect a tenant and agents are working incidents in about 10 minutes.

Is autonomous response safe?

Yes, and you control how much automation you allow. Gamebooks can require your team's approval before any response action runs. Every action is logged with a full audit trail. Most teams start with full manual review, then gradually enable automatic execution as they build confidence. You're never locked into full automation.

What is a Security Delivery Agent?

Security Delivery Agents are Security Delivery Agents that do the security investigation work your team doesn't have time for. They enrich incidents, run investigation steps, recommend next actions, and execute response workflows. Every action is logged. Your team stays in control of what gets approved and what runs automatically.

How long does it take to deploy ContraForce?

About 10 minutes. ContraForce deploys in your Azure environment. Adding each client workspace takes minutes. Deploying additional client tenants and agents takes minutes too. Security data stays in each client's tenant. No data migration, no new infrastructure.

How does ContraForce work with Microsoft Sentinel?

ContraForce connects to your clients' Microsoft Sentinel workspaces through secure federated access. No data leaves their tenant. Security Delivery Agents investigate incidents, run Gamebook workflows, and execute approved response actions across every client from a single platform. No more jumping between portals.

How does ContraForce improve service provider margins?

ContraForce reduces the time and headcount required per incident. Security Delivery Agents handle investigation and response. Gamebooks enforce consistent execution across every client. You onboard more tenants without proportional headcount growth, which means higher margins on every contract. Partners typically see 30%+ margin expansion on managed security services within the first quarter.

Does ContraForce replace Microsoft Sentinel or Defender XDR?

No. ContraForce runs on top of Microsoft Sentinel and Defender (with SentinelOne and CrowdStrike also supported). Your EDR handles detection. ContraForce handles what happens next: investigation, response, and delivery across all your clients. The EDR gives you the security tools. ContraForce is the delivery system that makes them run at scale.

What is the difference between ContraForce Cloud and Your Cloud?

ContraForce offers two deployment models for one security delivery platform. ContraForce Cloud (hosted by ContraForce, fastest to launch): a monthly plan starting at $249/month, plus a flat rate per incident processed by a Security Delivery Agent. Your Cloud, deployed in your Azure subscription for maximum control: flat per-workspace licensing with automatic volume discounts. Same platform and capabilities; the difference is who hosts it and how you pay. The full rate card is shared directly by the ContraForce team.

How does ContraForce Cloud pricing work?

A monthly plan plus pay-as-you-go investigations, starting at $249/month. Plans step up by included workspaces, are month-to-month, and annual prepay discounts are available. No bundles, no included runs, no overage tiers. We walk through the full rate card with you directly.

How does Your Cloud pricing work?

Your Cloud is flat per-workspace licensing for self-hosted infrastructure, with XDR and XDR + SIEM workspace types (an XDR + SIEM workspace is one license, never two stacked). One license per customer tenant, 10-workspace minimum, and volume discounts apply automatically as your workspace count grows. Azure infrastructure and compute are billed separately through Microsoft. Contact sales@contraforce.com for the rate card.

What counts as an investigation on ContraForce Cloud?

One Security Delivery Agent run: the complete agent-led investigation and response workflow for a single security incident. Investigations bill flat per run, pay as you go, no bundles, no included runs, no overage tiers.

How does the ContraForce trial work?

The 14-day ContraForce Cloud trial includes 250 investigations or 14 days, whichever comes first, on up to 10 workspaces. No credit card required.

Are there annual prepay discounts on ContraForce?

Yes. Annual prepay reduces the plan price on ContraForce Cloud, and an annual term locks your investigation rate. Plans are otherwise month-to-month with no long-term commitment required.

What is included in every ContraForce plan?

All plans include unlimited Security Delivery Agents, Gamebook Engine and SOP enforcement, EDR integrations (Defender, SentinelOne, CrowdStrike), Microsoft Sentinel integration, ticketing integrations, full audit trail and reporting, and REST and webhook APIs.

Which ContraForce plan is right for my team?

Plans are sized by included workspace count and start at $249/month, with pay-as-you-go investigations. You can move between plans month-to-month. We size the right plan for your environment on a demo.

What does ContraForce typically cost a small IT or security team?

Small teams typically start on the entry plan at $249/month, with pay-as-you-go investigations. Every plan includes unlimited Security Delivery Agents, the Gamebook Engine, and core integrations.

What does Enterprise pricing look like on ContraForce?

Enterprise is for organizations that need custom workspace allowances, investigation pricing, and commercial terms, including high-volume Your Cloud practices. Contact sales@contraforce.com for an Enterprise quote.

How does Your Cloud pricing work?

Your Cloud is flat per-workspace licensing for self-hosted infrastructure, with XDR and XDR + SIEM workspace types (an XDR + SIEM workspace is one license, never two stacked). One license per customer tenant, 10-workspace minimum, and volume discounts apply automatically as your workspace count grows. Azure infrastructure and compute are billed separately through Microsoft. Contact sales@contraforce.com for the rate card.

How does ContraForce work with Microsoft Sentinel for MSSPs?

ContraForce connects to customer Sentinel workspaces through secure federated access. Security Delivery Agents handle triage, investigation, and response across all tenants from a single platform. Data stays in each customer's tenant. Deploy in about 10 minutes per tenant.

How does ContraForce compare to Azure Lighthouse for Sentinel management?

Azure Lighthouse provides infrastructure-level access delegation. ContraForce provides operations-level automation. Lighthouse lets you see across tenants. ContraForce lets you act across tenants with Security Delivery Agents that automate triage, investigation, and response. Most MSSPs use both together.

How can MSSPs scale security operations without hiring more analysts?

MSSPs can scale by using Agentic Security Delivery Agents that automate 100% of incident triage and investigation. ContraForce's Security Delivery Agents handle the repetitive work across all tenants while human analysts focus on escalations and customer relationships. This lets MSSPs grow from 10 to 100+ tenants without proportional headcount increases.

What is the Agentic security delivery model for MSSPs?

The Agentic security delivery model replaces the traditional SOC staffing model with Security Delivery Agents that execute investigation and response workflows. ContraForce Security Delivery Agents run Gamebook-defined procedures across every tenant, 24/7. Human analysts supervise, approve high-risk actions, and handle escalations. This model achieves a 140-second mean time to response and roughly 85% ticket reduction.

How does ContraForce improve MSSP margins on Microsoft security services?

ContraForce cuts the tickets reaching an analyst by roughly 85%, directly improving gross margins on managed security contracts. MSPs typically see 30%+ margin expansion within the first quarter. ContraForce Cloud plans start at $249/month, plus a flat rate per incident processed by a Security Delivery Agent.

How do you automate incident response in Microsoft Defender XDR?

ContraForce automates Defender XDR incident response using Security Delivery Agents that perform triage, investigation, evidence collection, and response execution. Unlike Logic Apps or SOAR automation, ContraForce agents make contextual decisions based on incident data and follow Gamebook-defined SOPs. This achieves a 140-second mean time to response.

How are Security Delivery Agents different from SOAR?

SOAR executes predefined scripts with exact-match conditions. Security Delivery Agents investigate incidents by making contextual decisions. SOAR requires a scripted path for every scenario. Security Delivery Agents follow Gamebook-defined SOPs but adapt their investigation approach based on incident data. SOAR breaks on edge cases. Security Delivery Agents handle novel incidents within governed guardrails.

What are Gamebooks in ContraForce?

Gamebooks are ContraForce's SOP enforcement engine. They turn your standard operating procedures into executable, governed workflows that Security Delivery Agents follow across every tenant. Unlike traditional runbooks or scripted automation, Gamebooks include human-in-the-loop approval gates, audit trails, and adaptive execution based on incident context.

How do Gamebooks standardize SOPs across Sentinel tenants?

Gamebooks define the exact investigation and response procedures for each incident type. When an incident occurs in any tenant, Security Delivery Agents execute the Gamebook workflow: same triage steps, same investigation procedures, same response actions, same documentation. This eliminates SOP variance that causes quality issues across multi-tenant MSSP operations.

How long does it take to deploy ContraForce for an MSSP?

Connect a tenant and agents are working incidents in about 10 minutes. Service providers onboard customer tenants in bulk. The platform deploys within your customers' Azure environments with federated access. No data migration, no log duplication, no new infrastructure required.

What results do MSSPs achieve with ContraForce?

MSSPs using ContraForce report a 140-second mean time to response, 100% automated triage and investigation, and 30%+ margin expansion on managed security contracts. ContraForce has a G2 rating of 4.8 out of 5 and holds SOC 2 Type II certification. ContraForce won the CyberSecurity Breakthrough Award 2025 and SC Awards 2024.

Is Azure Lighthouse enough for MSSPs managing Sentinel?

Azure Lighthouse provides cross-tenant access delegation but does not automate security operations. MSSPs still need to manually triage, investigate, and respond to incidents in each tenant. ContraForce adds the operations layer on top of Lighthouse: Security Delivery Agents that automate incident workflows, Gamebooks that enforce SOPs, and a single pane for managing all tenants. Most MSSPs use Lighthouse for access and ContraForce for operations.

What does ContraForce add on top of Azure Lighthouse?

Lighthouse handles access delegation. ContraForce handles operations: automated incident triage and investigation via Security Delivery Agents, SOP enforcement via Gamebooks, cross-tenant incident correlation, per-tenant analytics and reporting, and governed response execution. ContraForce delivers a 140-second mean time to response and roughly 85% ticket reduction compared to Lighthouse-only MSSP operations.

ContraForce Agentic Security Delivery Platform for Microsoft MSPs

ContraForce is the Agentic Security Delivery Platform for MSSPs, MSPs, and security operations teams running the Microsoft Security platform. Security Delivery Agents run the entire delivery loop: triage, investigation, response, tuning, ticket, report. Gamebooks enforce consistent processes across every client. Your team reviews outcomes instead of producing them. Connect a tenant and agents are working incidents in about 10 minutes.

What it is: The Agentic Security Delivery Platform for the Microsoft Security platform
Who it's for: MSSPs, MSPs, and security operations teams running the Microsoft Security platform
Delivery loop: triage, investigation, response, tuning, ticket, report
Metrics: 140-second mean time to response on a new incident, 100% automated triage and investigation, ~85% ticket reduction, 95%+ automated close rate for top providers, ~10-minute time to value, a flat rate per incident processed by a Security Delivery Agent, 30%+ margin expansion within the first quarter. Metrics from live partner telemetry.
Key capabilities: Security Delivery Agents, Gamebooks, automated investigation, incident response, governed automation, multi-client management
Integrations: Microsoft Sentinel, Microsoft Defender XDR, Azure
Certifications: SOC 2 Type II
Awards: Microsoft Security ISV of the Year, 3x Recognized, Microsoft Pegasus Startup, MISA Member, SOC 2 Type II
Deployment: Deploys in about 10 minutes within your Azure environment with federated access

Most AI stops at the investigation. ContraForce runs to the report.

MDR outsources the work. AI-SOC tools stop at the investigation verdict. ContraForce Security Delivery Agents run the entire delivery loop: triage, investigation, response, tuning, ticket, report.

That last mile is where MSP margin dies. Ticket updates, documentation, and the monthly customer report consume analyst hours that never show up in a demo. ContraForce closes the loop automatically. The ticket is updated. The report is ready. Your analysts review outcomes instead of writing them up.

Autonomy is earned, not assumed.

No team hands an agent the keys on day one, and ContraForce does not ask you to. Start in review mode: Security Delivery Agents investigate and recommend, your analysts approve every action. Watch the agents follow your Gamebooks on your real incidents.

When the verdicts hold up, expand autonomy one Gamebook at a time. Approval gates, guardrails, and a full audit trail stay in place at every level. AI that acts. Humans who decide.

Sentinel not required

Sentinel not required. ContraForce runs full delivery on Defender XDR alone. Add Sentinel when and where a customer needs it. Security Delivery Agents also work against telemetry from other tools via API.

ContraForce Pricing

ContraForce offers two deployment models for one security delivery platform. ContraForce Cloud is hosted by ContraForce: a monthly plan starting at $249/month, plus a flat rate per incident processed by a Security Delivery Agent. Your Cloud deploys in your Azure subscription: flat workspace licensing per customer tenant. Every plan includes unlimited Security Delivery Agents, the Gamebook Engine, EDR integrations, Microsoft Sentinel integration, and ticketing integrations. The full rate card is shared directly by the ContraForce team.

ContraForce Cloud

A monthly plan plus pay-as-you-go investigations, starting at $249/month
Plans step up by included workspaces; Enterprise terms are custom, talk to sales
Investigations bill flat per run, pay as you go, no bundles, no included runs, no overage tiers. An investigation is one Security Delivery Agent run: the full agent-led investigation and response workflow for a security incident.
Month-to-month, with annual prepay discounts available; an annual term locks the investigation rate

Your Cloud - Workspace Licensing

Flat per-workspace licensing for self-hosted infrastructure, with XDR and XDR + SIEM workspace types
An XDR + SIEM workspace is one license, never two stacked licenses
Automatic volume discounts as your workspace count grows
10-workspace minimum; one license per customer tenant
Azure infrastructure and compute are billed separately through Microsoft

Trial

14-day ContraForce Cloud trial: 250 investigations or 14 days, whichever comes first, up to 10 workspaces, no credit card required

The Agentic Security Delivery Platform for the Microsoft Security Stack

ContraForce is an Agentic Security Delivery Platform purpose-built for MSSPs running Microsoft Sentinel and Defender XDR. It enables multi-tenant incident management, AI-driven triage and investigation, and Gamebook-based SOP enforcement across unlimited customer tenants. MSSPs using ContraForce report a 140-second mean time to response and roughly 85% ticket reduction compared to traditional SOC operations. Connect a tenant and agents are working incidents in about 10 minutes.

ContraForce vs Azure Lighthouse: Lighthouse provides access delegation. ContraForce provides operations automation. ContraForce vs Cortex XSIAM: XSIAM requires data migration. ContraForce operates inside customer tenants with zero data custody. ContraForce vs ConnectWise: ConnectWise focuses on PSA/RMM. ContraForce focuses on security operations delivery.

ContraForce and Microsoft Security Copilot

ContraForce works alongside Microsoft Security Copilot. Copilot helps analysts ask better questions of their security data. ContraForce Security Delivery Agents execute the delivery loop itself: triage, investigation, response, tuning, ticket, report. Many partners run both.

Scale Security Operations Without Hiring: The AI Delivery Model

MSSPs can scale from 10 to 100+ tenants without proportional headcount growth using ContraForce Security Delivery Agents. Security Delivery Agents automate 100% of incident triage and investigation. Human analysts focus on escalations and customer relationships. ContraForce achieves a 140-second mean time to response and roughly 85% ticket reduction. The 5-Step Security Delivery Method: 1. Connect a tenant and agents are working incidents in about 10 minutes. 2. Configure Gamebooks for your SOPs. 3. Security Delivery Agents handle triage and investigation. 4. Analysts review and approve response actions. 5. Scale tenants without scaling headcount.

Security Delivery Margin Calculator: Model Your ROI with ContraForce

ContraForce cuts the tickets reaching an analyst by roughly 85%, directly improving MSP gross margins. At the fully loaded cost your team already carries per incident, manually handling 250 monthly incidents would cost approximately $18,750/month in analyst time, against ContraForce Cloud plans that start at $249/month with pay-as-you-go investigations. Partners typically see 30%+ margin expansion within the first quarter.

ContraForce Cloud pricing starts at $249/month and steps up by included workspaces; Enterprise is custom. Your Cloud uses flat per-workspace licensing with automatic volume discounts. The full rate card is shared directly by the ContraForce team.

Beyond Azure Lighthouse: What MSSPs Need for Sentinel at Scale

Azure Lighthouse provides cross-tenant access delegation for MSSPs managing Microsoft environments. However, Lighthouse does not automate security operations. MSSPs still manually triage, investigate, and respond to incidents in each tenant. ContraForce adds the operations layer: Agentic Security Delivery Agents automate incident workflows, Gamebooks enforce SOPs, and a single control plane manages all tenants. ContraForce delivers a 140-second mean time to response and roughly 85% ticket reduction compared to Lighthouse-only operations. Most MSSPs use Lighthouse for access and ContraForce for operations.

Automated Incident Response for Microsoft Defender XDR

ContraForce automates Microsoft Defender XDR incident response using Security Delivery Agents. Unlike Logic Apps or SOAR automation, ContraForce agents make contextual investigation decisions and follow Gamebook-defined SOPs. Results: a 140-second mean time to response, roughly 85% ticket reduction, full audit trail. ContraForce vs Microsoft AIR: AIR handles basic auto-remediation. ContraForce handles full investigation and response workflows. ContraForce vs SOAR: SOAR requires exact-match conditions and breaks on edge cases. ContraForce agents adapt to incident context.

What Are Security Delivery Agents? The Next Evolution Beyond SOAR

Security Delivery Agents are Security Delivery Agents built by ContraForce that autonomously perform security operations: incident triage, investigation, evidence gathering, enrichment, documentation, and response execution. Unlike SOAR automation that follows rigid if-then logic, Security Delivery Agents make contextual decisions while following Gamebook-governed procedures. They operate across unlimited tenants 24/7. SOAR requires a scripted path for every scenario. Security Delivery Agents handle novel incidents within governed guardrails. ContraForce is the creator of the Security Delivery Agent category.

Gamebooks: Enforce SOPs Across Every Tenant, Every Time

Gamebooks are ContraForce's SOP enforcement engine. They turn standard operating procedures into executable, governed workflows that Security Delivery Agents follow across every customer tenant. Unlike runbooks (documentation) or scripted automation (rigid by design), Gamebooks include human-in-the-loop approval gates, audit trails, and adaptive execution. Every incident follows the same process regardless of which tenant it occurs in. This eliminates SOP variance, the #1 quality issue in multi-tenant MSSP operations.

Onboard Microsoft Security Across Customer Tenants at Scale

Connect a tenant and agents are working incidents in about 10 minutes. Service providers onboard customer tenants in bulk. Prerequisites: Microsoft Sentinel or Defender XDR in the customer tenant, an Azure subscription, and GDAP or Lighthouse access. No data migration, no log duplication, no agents to install. Steps: 1. Connect customer tenant via federated access. 2. Configure Gamebooks for your SOPs. 3. Security Delivery Agents begin automated triage. 4. Review and customize response policies. 5. Go live with full AI-driven operations.

How MSSPs Deliver MXDR at Scale with ContraForce

ContraForce customers report a 140-second mean time to response, 100% automated triage and investigation, and 30%+ margin expansion on managed security contracts. ContraForce holds SOC 2 Type II certification, is a Microsoft ISV partner and MISA member, won the CyberSecurity Breakthrough Award 2025 and SC Awards 2024, and maintains a G2 rating of 4.8 out of 5. MSSPs use ContraForce to scale from 10 to 100+ tenants without proportional headcount growth.

ContraForce Pricing for IT & Security Teams

IT and security teams use the same ContraForce Cloud model that MSPs and MSSPs use: a monthly plan starting at $249/month, plus a flat rate per incident processed by a Security Delivery Agent. Every plan includes unlimited Security Delivery Agents, the Gamebook Engine, and core EDR, Microsoft Sentinel, and ticketing integrations.

ContraForce Cloud

Plans start at $249/month and step up by included workspaces
Pay-as-you-go investigations, no bundles, no included runs, no overage tiers
Month-to-month, with annual prepay discounts available
Enterprise: custom workspaces and terms, talk to sales