Agentic Security Delivery Platform
Reviewed by ContraForce team
Run the work.
Not just the incidents.
ContraForce runs the full delivery: onboarding, triage, investigation, response, ticketing, reporting, and tuning. Across every client. Through your standard operating procedures (SOPs). Your team owns every consequential decision.
Recognized by
- Microsoft Security ISV of the Year, 3x Recognized
- Microsoft Pegasus Startup
- MISA Member
Your team already runs endpoints, email, and identity. Now clients want security delivery too.
Your clients expect managed security. But building a security practice changes your entire operation: new roles, new margins, new risk.
You don’t need a bigger team. You don’t need more tools.
You need a platform that lets your existing team deliver security outcomes across every client, with AI doing the work they don’t have time for. Not another tool to monitor. Not an outsourced black box. A delivery system your team actually runs.
One Platform. Every Client.
Full Agentic Security Delivery.
Your Tenant
- Multi-Client
Management - AI Investigates
Incidents Automatically - Your Team Reviews
and Approves - Full Audit Trail
for Every Client
Agentic Security Delivery Platform
- Project
- Security
Delivery Agent - Secure Access
- Client Workspace
Most AI stops at the investigation. ContraForce runs to the report.
MDR outsources the work. AI-SOC tools stop at the investigation verdict. ContraForce Security Delivery Agents run the whole loop and close it, so the ticket is updated, the report is ready, and your analysts review outcomes instead of writing them up.
- triage
- investigation
- response
- tuning
- ticket
- report
How ContraForce works.
Connect your workspaces
Connect your existing security stack through APIs, with no endpoint agents.
Workspace baselines
Apply shared settings across workspaces with versioned profiles.
You stay in control
Your team makes key decisions, with approval queues and a full audit trail.
Autonomy is earned, not assumed.
No team hands an agent the keys on day one, and ContraForce does not ask you to. Start in review mode: Security Delivery Agents investigate and recommend, your analysts approve every action. Watch the agents follow your Gamebooks on your real incidents.
When the verdicts hold up, expand autonomy one Gamebook at a time. Approval gates, guardrails, and a full audit trail stay in place at every level. AI that acts. Humans who decide.
Step 1
Review mode
Agents investigate and recommend. Your analysts approve every action.
Step 2
Earned autonomy
Verdicts hold up on your real incidents. You expand autonomy one Gamebook at a time.
Step 3
Governed at every level
Approval gates, guardrails, and a full audit trail stay in place no matter how far you go.
A delivery system you can verify.
6
Stages in the complete delivery loop
Triage through customer-ready report.
0
Duplicated customer log stores
Federated access keeps security data in the customer environment.
1
Multitenant control plane
Operate customer environments from one governed workspace.
1
Attributable audit trail
Evidence, decisions, approvals, and actions stay reviewable.
What MSPs use ContraForce to do.
Launch new revenue lines.
Stand up MXDR or co-managed SOC services in days, not quarters. The platform replaces the SOC build-out, not the analyst. Capture the security revenue your team has been walking away from.
Onboard customers tomorrow. Not next quarter.
Compress 2–3 month tuning cycles into 40 days or less. Start billing on day two instead of month three. Every week you save is a week of recurring revenue captured earlier.
Expand what you can sell.
Connect Defender, SentinelOne, and CrowdStrike without forcing a stack migration on your customer. Win the deals you used to walk away from because the EDR didn’t match.
Protect your margin.
A monthly plan plus a flat rate per incident a Security Delivery Agent processes. No per-user or per-endpoint charges. ContraForce bills you, never your clients. The margin math works the same on client ten as it does on client one hundred.
The architecture earns the outcomes.
Federated by design
Your customers’ data never leaves their tenant. Multi-tenant operations without multi-tenant risk.
Governed, not scripted
Gamebooks turn your SOPs into enforceable workflows. Same SOP across every client, every time, with approval gates and a full audit trail at every level of autonomy.
API-only deployment
No agents to install. No logs to migrate. Plug a client in and Security Delivery Agents start working on the first incident.
Built for the Microsoft security stack.
Trusted by the Microsoft ecosystem.
Client security data never leaves their tenant. ContraForce connects through federated access with zero data duplication, so data residency requirements are met by default. Trusted by Microsoft partners and customers across 15+ countries.
MISA Member
Microsoft Intelligent Security Association
Microsoft Pegasus
Microsoft Pegasus Startup Program
SOC 2 Type II
Audited and certified
Frequently asked questions.
What is ContraForce?
ContraForce is the Agentic Security Delivery Platform for MSSPs, MSPs, and security operations teams. Security Delivery Agents run the entire delivery loop on the Microsoft Security platform: triage, investigation, response, tuning, ticket, report. Gamebooks enforce the same procedure across every client. Your team reviews outcomes instead of producing them.
Is autonomous response safe?
Autonomy is earned, not assumed. Start in review mode: Security Delivery Agents investigate and recommend, your analysts approve every action. When the verdicts hold up, expand autonomy one Gamebook at a time. Approval gates, guardrails, and a full audit trail stay in place at every level. AI that acts. Humans who decide.
What is a Security Delivery Agent?
A Security Delivery Agent performs security operations work end to end: it triages an incident, investigates across data sources, gathers and documents evidence, executes response actions, tunes the detection, updates the ticket, and produces the report. It follows your Gamebooks and stops at the approval gates you set.
How long does it take to get value from ContraForce?
Connect a supported tenant, validate the delegated access and Gamebook, then measure readiness against an eligible incident in your own environment. There are no logs to migrate, and security data stays in each client’s tenant.
Do I need Microsoft Sentinel to use ContraForce?
Sentinel not required. ContraForce runs full delivery on Defender XDR alone. Add Sentinel when and where a customer needs it. Security Delivery Agents also work against telemetry from other tools via API, including SentinelOne and CrowdStrike.
How does ContraForce improve service provider margins?
Security Delivery Agents run triage, investigation, response, tuning, ticketing, and reporting under your Gamebooks. Incident processing bills at a flat rate per incident, pay as you go, so you can model delivery cost against your own incident mix, analyst cost, and approval policy before quoting a customer.
Does ContraForce replace Microsoft Sentinel or Defender XDR?
No. ContraForce runs on top of the Microsoft Security platform, with SentinelOne and CrowdStrike also supported. Your EDR handles detection. ContraForce handles what happens next: investigation, response, tuning, ticketing, and reporting across all your clients. The EDR gives you the security tools. ContraForce is the delivery system that runs them at scale.
How does ContraForce relate to Microsoft Security Copilot?
ContraForce works alongside Microsoft Security Copilot. Copilot helps analysts ask better questions of their security data. ContraForce Security Delivery Agents execute the delivery loop itself: triage, investigation, response, tuning, ticket, report. Many partners run both.
Can I control which actions a ContraForce agent takes?
Yes. ContraForce lets you choose investigation only or investigation and response. Decide whether agents can run Gamebooks, require human approval for sensitive actions, and review the audit trail.
Does ContraForce support VIP lists?
Yes. ContraForce supports VIP lists through Agent Policies. Set rules to block agent investigations involving VIP users so those incidents stay with your analysts for review and response.
Can I set different automation levels per tenant?
Yes. ContraForce lets you configure agents, policies, Gamebook permissions, and approvers per workspace. Match automation to each customer’s requirements, with analysts supervising where needed.
Can ContraForce create a ticket in my PSA from an incident?
Yes. ContraForce lets analysts create or link tickets from an incident, keeping the investigation and evidence attached. Your team can follow the work from the incident to the connected ticketing system.
Does ContraForce store customer security data?
Your logs and telemetry stay in your SIEM or XDR. ContraForce stores the incident records, verdicts, and evidence its agents produce in your assigned regional deployment, without operating a separate security data lake.
Connect one workspace. See what happens on the first incident.
Time to value is zero. The moment your first incident lands, Security Delivery Agents start working. Most MSPs see their first investigation completed in under 60 seconds.