The Unit Economics of an AI-Run Tier-1 for MSSPs

MSSP margins are, at heart, a staffing equation. Revenue scales with customers. Cost scales with analysts. And in a traditional SOC, analysts scale with customers, because every new customer brings new alert volume that someone has to triage. That is why so many providers grow revenue without growing margin.

This post builds a simple unit-economics model for tier-1 and shows what changes when AI runs it. Every number below is illustrative. They are not benchmarks, customer results, or mysoc.ai pricing. They are round figures chosen to make the mechanics visible. Swap in your own.

The traditional model

Illustrative assumptions:

• 100 customers at an average of $3,000 per month: $3.6M in annual revenue.
• A fully loaded analyst cost of $110,000 per year, including salary, benefits, training, and the cost of replacing people who leave.
• 4 customers per analyst, the middle of the 3–5 range where traditional MSSPs tend to plateau.

That is 25 analysts and $2.75M in analyst cost: 76% of revenue before you have paid for tooling, SIEM ingest, facilities, or sales. Each customer carries $27,500 a year in analyst cost against $36,000 in revenue.

Worse, the cost arrives first. You hire ahead of revenue because a new analyst takes months to become productive, and onboarding a new customer has traditionally meant weeks of unbilled setup.

Where the tier-1 hours go

Headcount scales with customers because tier-1 work scales with alert volume. Every alert has to be looked at, enriched, correlated, and closed or escalated, and the overwhelming majority close as benign. Add the customer-facing work, including incident notifications, status questions, and monthly reports, and you have the bulk of a traditional analyst's week. Very little of it is the work they were hired for.

What changes with an AI-run tier-1

• Noise is removed before anyone sees it. SiemCore eliminates around 99% of events by matching them to each tenant's baseline.
• The rest is triaged and investigated by AI. Enrichment, correlation, MITRE ATT&CK mapping, and a written, evidence-backed verdict for each finding.
• Customer communication is automated. Notifications, chat answers grounded in the customer's own incident data, and per-customer reports.
• Analysts handle escalations. Their workload tracks verified threats, not raw alert volume.

The figure we use for this across the site is 5x more customers per analyst. In the illustrative model, that means 20 customers per analyst instead of 4.

The same 100 customers, revisited

• Analysts: 5 instead of 25.
• Analyst cost: $550,000 instead of $2.75M, or 15% of revenue instead of 76%.
• Analyst cost per customer: $5,500 a year instead of $27,500.

The platform is not free, and this model does not pretend it is. Put your platform cost on the other side of the ledger and compare it with the $2.2M difference in analyst cost. That is the real decision, and it is one you can make with a spreadsheet rather than a leap of faith.

The floor does not disappear

Be careful with straight-line math at small scale. A 24/7 escalation bench has a minimum size whatever your customer count: someone has to be on call every hour of every week, with cover for leave and sickness. If you have 15 customers, AI will not get you to one analyst. What it does is let that minimum bench carry far more customers before you need to hire again. The margin comes from the customers you add on top of the floor.

What if the multiplier is lower?

A good model should survive pessimistic assumptions, so stress-test it. Suppose that in your environment the gain is 3x rather than 5x: 12 customers per analyst instead of 4. In the same illustration, 100 customers need about 9 analysts instead of 25, and analyst cost falls from $2.75M to roughly $1M, or from 76% of revenue to under 28%. The conclusion does not hinge on hitting the headline number. Even a partial shift moves analyst cost from the dominant line in the P&L to a manageable one.

The variable that matters most is not the multiplier. It is how much of your current analysts' time is genuinely tier-1: triage, enrichment, and routine customer communication. Measure that first, because it is the part that changes.

Where the freed capacity goes

Lower analyst cost per customer is a choice, not just a saving. Providers tend to use it in one of three ways:

• Margin: keep pricing where it is and let the difference flow to the bottom line.
• Price: compete for mid-market customers who could never afford a 24/7 service at traditional cost.
• Depth: move senior analysts toward threat hunting, incident response, and advisory work that customers value and that commands higher rates.

Most do a mix. The point is that the decision becomes strategic rather than forced by headcount.

Growth is where it compounds

The static comparison understates the effect, because the bigger change is at the margin. In the traditional illustration, signing 20 new customers means hiring five analysts, months before they are fully productive. In the AI-run version it means about one, and possibly none if the existing bench has headroom.

Onboarding changes too. When a new customer environment is monitored in under a day rather than after weeks of setup, revenue starts sooner and your engineers are not tied up in onboarding projects. Across a few dozen new customers a year, the unbilled weeks you get back add up.

What it does not change

• Senior judgment. Escalations still need experienced responders, and they are the hardest people to hire. AI frees them from tier-1 work; it does not replace them.
• Customer relationships. The quarterly review, the incident debrief with a worried CFO, the renewal conversation: those stay human.
• Accountability. The provider still owns the outcome. That is why AI verdicts carry their evidence and why analysts should spot-check closures.

Running your own numbers

To adapt the model you need five inputs: number of customers, average revenue per customer, fully loaded analyst cost, your current customers per analyst, and your minimum 24/7 bench. Calculate analyst cost at your current ratio, then at five times that ratio, floored at your minimum bench. The difference is the budget the platform has to beat. Then repeat the exercise for next year's growth plan, because that is where the gap widens.

MSSPs have long sold expertise priced by the hour. An AI-run tier-1 lets you sell outcomes priced by the customer. If you are running these numbers for your own business, our partner program is built around this model, and a demo is the place to discuss your deployment and commercial requirements.