MSSP Margin Calculator: Model Your Security Delivery Economics
Reviewed by ContraForce team
See how a flat per-investigation rate changes your delivery economics. Adjust the inputs to match your operation and watch the margin impact in real time.
No credit card. Connect one workspace: scoped Entra ID application consent, no endpoint agents, no log forwarding.
The Numbers That Matter
6
Stages in the complete delivery loop
Triage through customer-ready report.
0
Duplicated customer log stores
Federated access keeps security data in the customer environment.
1
Multitenant control plane
Operate customer environments from one governed workspace.
1
Attributable audit trail
Evidence, decisions, approvals, and actions stay reviewable.
Model Your Margin
One flat rate per incident processed by a Security Delivery Agent. Every incident, every time. No token math, no compute surprises, no surge billing. You can quote your service knowing exactly what delivery costs.
Workspaces Managed
Incidents Requiring Analyst Follow-Up
Use the rate observed in your own proof of value.
Avg Incidents per Workspace / Month
What One Incident Costs You Today
Your fully loaded cost to take one incident from alert to closed ticket and report.
Your Delivery Economics
- Monthly incidents
- Cost today
- Tickets still reaching an analyst
With ContraForce
Estimated total cost of delivery
Net Monthly Savings
Scenario Result
Modeled delivery-cost change using your inputs; not a guaranteed outcome
No credit card. Connect one workspace: scoped Entra ID application consent, no endpoint agents, no log forwarding.
Estimates use a flat rate per incident processed by a Security Delivery Agent and the analyst follow-up rate you select. Plans are sized separately by workspace allowance. Results are user-modeled scenarios, not ContraForce performance claims or guaranteed savings. We walk through the full rate card with you directly.
Frequently asked questions.
What does ContraForce actually cost per incident?
A flat rate per incident processed by a Security Delivery Agent, pay as you go. One flat rate, every incident. No token math, no compute surprises, no surge billing. This calculator estimates against that rate. We walk through the full rate card with you directly.
What should I use for the analyst follow-up assumption?
Use your own proof-of-value result: the share of eligible incidents that still require analyst work after the configured Gamebooks and approval policy run. The calculator starts with a neutral modeling assumption, not a ContraForce performance claim.
How should I interpret the modeled savings?
The result is a scenario based on your incident volume, current handling cost, analyst follow-up assumption, and the configured processing rate. It is not a forecast or guaranteed margin outcome. Validate every input against your own workflow before using it in a business case.
How quickly will I see a return?
Measure this in a proof of value. Record connection readiness, eligible incident volume, analyst touches, processing cost, and any approval or integration constraints, then compare the observed delivery cost with your baseline.
Can I start small and scale up?
Yes. Start with your top 3-5 clients. Measure the impact on mean time to response, analyst throughput, and delivery cost, then expand to your full client base. Because investigations bill per run, costs scale linearly and predictably.
What plan will I need?
Plans are sized by workspace allowance, and investigations bill separately per run. We walk through the full rate card and build your unit economics with you on a call.
Get a Custom Margin Analysis
Our team will model the specific margin impact for your operation based on your client count, incident volume, and current cost to handle an incident.
No credit card. Connect one workspace: scoped Entra ID application consent, no endpoint agents, no log forwarding.