Normalized claim
Incident automation: 90% increase
AI agents handle over 90% of Level 1 SOC tasks.
MicrosoftEvidence: Medium50/100
ContraForce builds AI agents to automate SOC incident triage and response using Azure OpenAI and Microsoft Sentinel (MXDR for MSPs)
Use case typeWorkflow automationUpdated Jun 20, 2026
ContraForce is a cybersecurity startup that built a multi-tenant Security Delivery Platform for managed security service providers (MSPs). The platform operationalizes Microsoft Sentinel, Microsoft Defender XDR, Microsoft Entra ID, and Microsoft Foundry / Azure OpenAI, with a no-code automation layer called Gamebooks. AI agents triage, investigate, and execute supervised or autonomous response actions so MSPs can scale 24/7 SOC operations and manage more customers.
- Organization
- ContraForce
- Industry
- Tech & Comms
- Location
- United States
- Published
- June 2026
Reported outcomes
60x
incident response speedTime & speed
+90%incident automation+1,000%customer capacity per analyst−93%cost per incident40 countnew customers added after trial
Strategic outcomes
Scale & capacityEnabled MSPs to scale 24/7 SOC operationsNew business modelUnlocked premium security service tiersCustomer experience & trustImproved SLA compliance and customer satisfactionNew business modelTurned security delivery into a growth engine for MSPs
Why do we believe this?Outcome claims, sources, and evidence checks
Normalized claim
Customer capacity per analyst: 1,000% increase
analysts could manage up to 10× more customers.
Normalized claim
Cost per incident: 93% decrease
93% Reduced Cost per Incident
Normalized claim
Incident response speed: 60 x increase
60X Faster Incident Response
Normalized claim
New customers added after trial: 40 count increase
Providers added 40 customers, and analysts manage 10× more, incidents resolve in minutes.
Why do we believe this deployment?Customer identity, provider attribution, maturity, and source checks
- Customer
- ContraForce
- Provider
- Microsoft
- Maturity
- Unknown
- Linked source
- Microsoft Customer Stories
No explicit deployment-stage evidence found.
Customer identity supportedSource describes one deploymentMaturity evidence evaluated
Primary read
Use case focus
Showing 1 of 1
- 1Workflow automation
- Traditional security tools were complex and built for large enterprises, leaving MSPs unable to afford or scale 24/7 SOC operations.
- Incident investigation and response required too much analyst effort and time.
- ContraForce built a multi-tenant Security Delivery Platform around Microsoft Sentinel, Defender XDR, Entra ID, and Microsoft Foundry.
- Its Gamebooks no-code layer orchestrates incident response across tenants.
- AI agents handle triage, investigation, dispositioning, and supervised or autonomous response actions to automate Level 1 SOC work.
- MSPs added new customers they had previously declined due to resource constraints.
- Analysts can manage up to 10x more customers.
- Incident response now happens in minutes instead of hours.
- MSPs reduced cost per incident and improved margins.
- Some MSPs launched premium AI-augmented MXDR service tiers.
Architecture
ContraForce built a multi-tenant security delivery platform with dedicated workspaces per MSP customer. The platform centralizes management of Microsoft Sentinel and Microsoft Defender XDR, uses Microsoft Entra ID for identity, and layers AI agents from Microsoft Foundry / Azure OpenAI plus Foundry Agent Services to triage incidents, investigate them, and carry out supervised or autonomous response actions. A no-code Gamebooks layer orchestrates response workflows across environments while preserving tenant isolation and compliance.
Sources & evidence1
Evidence: Medium50/100Evidence strength
- Customer explicitly identified
- Primary source available
- Quantified outcome available
- Technical implementation details available
Type: Customer StoryPublished: Jun 20, 2026Publisher: MicrosoftEvidence: PrimaryConfidence: High
AI-generated summary. Verify important details with the linked sources before relying on this case.
Explore related AI use cases
Customer evidence
Provider evidence
AI patterns
Browse the catalog
Was this useful?
Community
Comments
No published comments yet.