Solutions · MSSPs and MSPs
Run MSSP services for every client from one EDR console.
ThreatBreaker gives MSSPs and MSPs managed endpoint security for all their clients: one multi-tenant console, each client's data kept apart, and an AI agent that investigates and contains incidents before your techs open the ticket.
30 minutes. A real console, not slides.
The MSSP services your clients expect, and what covers each
Whatever you call the offer, clients judge MSSP services on the same five things. Here is what ThreatBreaker gives your team for each.
Monitoring
Clients expect: Every endpoint watched, even when the office internet is down
Covered by: Detection on the device itself: Sigma and YARA-X rules, behavioural heuristics and an ML model, online or not
Alert triage
Clients expect: Real threats separated from noise, fast
Covered by: An AI agent investigates each detection: a narrative, the MITRE ATT&CK technique, a risk score and a false-positive likelihood
Incident response
Clients expect: Attacks contained before they spread
Covered by: Isolation, process kill, quarantine and more than thirty remote commands, approved by a person by default
Reporting
Clients expect: A clear story in the quarterly business review
Covered by: Incident timelines and scheduled CVE scans, kept per client
Compliance evidence
Clients expect: Proof for auditors and insurers
Covered by: Forensic evidence packages with chain of custody
For an MSP, these five are the usual step into MSP cybersecurity: start with managed EDR services for your best clients and grow into a full MSSP offer.
Looking to hire an MSSP rather than become one? Tell us your company size and where you are, and we will introduce you to a ThreatBreaker partner. Find a partner →
Multi-tenant EDR: one console, every client
You log in once and see a list of your clients. Clicking one shows only that client's machines and alerts. Nothing from client A is ever visible inside client B.
Switch tenants in one click
Every client is a separate tenant with its own data, users and policies. An aggregate view shows all of them at once.
A licence pool you allocate
Buy licence slots once and assign them to clients yourself, instead of raising a purchase order for every onboarding.
White-label, per client
Apply your own branding to each client's view, so the console looks like your service.
Clients enrol themselves
Send a referral link and a new client's endpoints join the right tenant without a ticket.
Managed endpoint security your team can run without a SOC
Detection runs on the endpoint itself, on Windows, Linux, macOS and ARM64, so it keeps working when a client's internet does not. What your techs do with it:
Alerts arrive already investigated
An AI agent turns each detection into an incident: what happened, the MITRE ATT&CK technique, a risk score and the recommended next step.
Approval before anything destructive
Built-in playbooks ship disabled, and by default they propose isolation or a process kill for a person to approve. Auto, the only mode that acts on its own, is opt-in per playbook.
Contain in one click
Network isolation, process kill, quarantine and more than thirty remote commands, from the same incident view. Hunt across every client's fleet by hash, file name or path.
Evidence for the client report
Each incident keeps a forensic evidence package and a timeline, and scheduled CVE scans run per client. Both feed the QBR, the insurer or the auditor.
Your rules, per playbook
Pick a mode to see what happens to the same incident. Require approval is the default; Auto is the only mode that acts without a person, and you switch it on per playbook.
How SOC automation works in ThreatBreaker →Ransomware behaviour · Client 04 · LAW-MB-07
How many endpoints can one analyst run?
Move the slider to your client base. Both assumptions are editable, and the result is headcount, not price.
| Endpoints | Analysts today | With ThreatBreaker |
|---|---|---|
| 1,000 | 1 | 1 |
| 5,000 | 5 | 1 |
| 10,000 | 10 | 2 |
| 25,000 | 25 | 5 |
Illustrative. Real coverage depends on your client mix, SLAs and which playbooks you promote to Auto. Assumes 160 working hours per analyst per month.
Managed EDR, priced per endpoint
ThreatBreaker is licensed per endpoint. You decide how to package it for your clients: as managed EDR services on their own, or inside a wider MSSP offer. Partner pricing is shared one to one, under NDA.
Works with the tools you already run
Available now
- REST API
- Webhooks
- SIEM forwarding
- Not-for-resale (NFR) licences for your own environment
On the roadmap
- ConnectWise
- NinjaOne
- Datto RMM
- Kaseya
RMM and PSA integrations are not built yet. Until they are, the API and webhooks connect ThreatBreaker to your ticketing and alerting.
We do not sell to your clients.
We do not sell ThreatBreaker to your clients and we do not contact them.
Questions MSPs ask us
- What is an MSSP?
- A managed security service provider runs security for other companies under contract: monitoring their systems, responding to attacks and reporting on both.
- What is the difference between an MSP and an MSSP?
- An MSP keeps a client's IT running; an MSSP is accountable for its security, usually under an SLA. Many MSPs now offer both.
- What is the difference between a SOC and an MSSP?
- A SOC (security operations centre) is the team and process that watches for and responds to attacks. An MSSP is a business that sells that capability to other companies, running its own SOC or a co-managed one with the client's IT team.
- Is ThreatBreaker an MDR service?
- No. ThreatBreaker is the platform. You deliver the managed detection and response (MDR) or managed EDR service to your clients, under your own brand and SLA.
- How do I add security services to my MSP without hiring a SOC team?
- Start with managed EDR for your best clients. ThreatBreaker investigates each alert and proposes the response, so your existing techs approve actions instead of triaging raw alerts.
- Can I manage all my clients from one console?
- Yes. Each client is an isolated tenant, and you switch between them, or see all of them together, from one multi-tenant console.
- Can I white-label ThreatBreaker?
- Yes. You can apply your own branding per client, so the console presents as your service.
- How is ThreatBreaker licensed?
- Per endpoint. Partners buy a licence pool and allocate it to their clients themselves. Partner pricing is shared under NDA.
- Does it integrate with ConnectWise, NinjaOne or Datto?
- Not yet: RMM and PSA integrations are on the roadmap. Today ThreatBreaker offers a REST API, webhooks and SIEM forwarding.
- Do you sell directly to my clients?
- No. We do not sell ThreatBreaker to your clients and we do not contact them.
See it on your own clients' endpoints.
A 30-minute walk through the multi-tenant console, or a conversation about joining the partner program.