A ranked "needs attention" list
Every client's sources, freshness, open cases and failed checks on one screen, ranked by what needs a person first. Trends over the month beside it, so a client that is drifting shows before it breaks.
Managed security service provider (MSSP) software is the platform a provider uses to run security for many client organisations at once. The questions that decide whether it is any good: can you see every client's health in one place, act through each client's own approval gate, push a detection to all of them in one move, hunt across them, and bill each the way they agreed. This page says what Cyvantic's provider console does, how a client stays in control of it, and what to ask of any platform you evaluate.
CONSENTED · each client can suspend or end the delegation at any time.
| client | health | cases | approvals | service |
|---|---|---|---|---|
| aldermoor-legal | source stale · 6 h | 4 | 2 waiting | at risk |
| northbridge | 2 failed checks | 3 | 1 waiting | on track |
| fenwick-clinics | drifting · 30 d | 1 | 1 waiting | on track |
| kestrel-logistics | healthy | 1 | none | on track |
| orbis-retail | healthy | 0 | none | on track |
| tallis-capital | healthy | 0 | none | on track |
A provider's day is the same six jobs, repeated per client. The console does them across the whole fleet, and every read is grouped over the clients the person is allowed to reach, never the whole platform.
Every client's sources, freshness, open cases and failed checks on one screen, ranked by what needs a person first. Trends over the month beside it, so a client that is drifting shows before it breaks.
One queue of every client's cases, with the agent's verdict, evidence and proposed response already on each. Open a case and you are in that client's workspace, with a banner that says whose org you are in.
An approvals inbox across clients. Every decision runs through the client's approval gate and is limited by the authority matrix that client set: which kinds of action the provider may approve, and which stay with the client.
Run a hunt across every client you reach in one move. A malicious finding becomes a case in that client; an exposure lands in that client's risk register, attributed to the provider who found it.
Write a detection once and push it to the clients you choose. It arrives as that client's own rule, visible and tunable in their tenant, so a client who ends the relationship keeps working protection.
Each client has a page with cases, sources, approvals, contacts and the monthly service report; a policy with its service level, health rules, routing and runbook; and billing: who pays, the cap, whether the provider rebills.
A provider person reaches a client through a delegation the client's administrator granted. The client can suspend it or end it at any moment, and every action taken under it is attributed to the provider person who took it, in the client's own audit ledger.
The client decides which kinds of response action the provider may approve on their behalf: disable an account, yes; delete a mailbox rule, yes; anything touching a production system, no. The approval gate enforces it; the console cannot route around it.
Nothing is copied into a provider tenant. The console reads across clients through the delegation, in each client's own region, and the client's data trains nothing. A client who leaves takes a complete record and working detections with them.
The topbar's organisation chip switches tenants, and a cyan "managed" banner states whose org the provider is in. There is no quiet mode.
The provider pays, with a cap per client and the option to rebill at your own price; or the client pays Cyvantic directly and sees exactly what the provider sees. Set per client, changed monthly.
The same two models as every customer: usage (data with retention, plus the AI work, inside caps) or a fixed monthly figure per client, at the provider rate. No seats, no tiers, no minimum term. Providers, on the pricing page.
Generated per client from the record: cases, verdicts, actions, posture movement and coverage. Yours to send under your name, with the evidence behind every line.
You should see every client's state on one screen and act from it, with each action attributed to the person and landing in the client's own ledger.
If the answer is "your analysts", the platform scales with your headcount. An agent that investigates every alert for every client scales with your client list instead.
Clients increasingly ask. A platform that cannot express "the provider may approve identity actions but not production changes" will cost you the client who needs it.
Their record, their detections, their data in their region. Lock-in by data hostage is a short-term strategy.
And does it arrive as the client's own rule, tunable in their tenant, or as something only you can see?
Per client, with who pays, a cap and rebilling as first-class settings, not a spreadsheet beside the platform.
Every vendor has a list. Ours today: the served data region is the European Union (Ireland), with an in-country region for the United Arab Emirates in build; the posture scan connects Microsoft 365, AWS and domains, with Azure, Google Workspace and Cloud, and Okta next. Ask us anything else and we say what is built.
Ask for the provider rate and we reply, from a person who builds the product, within two working days. Or start with the free posture scan on a client's Microsoft 365, AWS or domain: read-only, no logs, minutes. No charge, no sales call required, no credit card.