Launching an MDR Practice: MSSP Guide

The three viable MDR pricing models are: per-endpoint, per-log-volume, or per-outcome. Each maps to a different client-acquisition motion. Per-endpoint sells to security-conscious CIOs; per-log-volume aligns with data-heavy enterprises; per-outcome (verdicts triaged, incidents contained) matches ManySignal's economics best but requires trust.

Whatever you pick, price the shared-service coverage separately from environment-specific detection engineering. Shared costs (24/7 monitoring, ManySignal subscription passthrough) are predictable; custom detections are project-priced.

ManySignal's multi-tenant model gives each client its own tenant with independent data, detections, RBAC, autonomy grants, and kill switch. The MSSP operator has a top-level MSSP console that switches contexts across tenants with full audit of who viewed what.

Never share detections between tenants by default. Publish shared content from a signed ruleset library that tenants opt into — this preserves per-client customisation and prevents cross-client leakage.

24/7 coverage does not mean 24/7 analysts. The ManySignal triage agent works every alert to a verdict autonomously; humans handle escalations. A viable US-only MSSP shift is one primary analyst 8am-8pm plus on-call for P1 pages after hours. Global MSSPs run three follow-the-sun 8-hour rotations.

Define P1/P2/P3 SLAs in the MSA. Standard: P1 acknowledged in 5 min, contained in 15; P2 acked in 15, contained in 1h; P3 acked in 1h, contained in 8h. ManySignal's response agent handles containment inside the SLA; the human confirms.

Prospective enterprise clients will demand your SOC 2 report before your first proof-of-value. Achieve Type I in the first 90 days of practice launch; Type II within 12 months. ManySignal's own SOC 2 + ISO 27001 substantiates the platform layer — you're on the hook for the operator layer.

The relevant Trust Services Criteria for an MDR practice are CC6 (logical access), CC7 (system operations), and CC8 (change management). Map each to the operational controls in your runbook so the auditor doesn't have to invent evidence.

Standard onboarding: week 1 connectors + tenant provisioning, week 2 baseline learning, week 3 shadow-mode with weekly report, week 4 production cutover with named-analyst introduction. Communicate this timeline in every SOW so clients don't expect same-day.

The first monthly executive report — auto-generated by the report agent from case data — is the single highest-value client artefact. It shows verdicts rendered, incidents contained, coverage growth, and MTTR. Send it on the same date every month, unchanged in format.