01
Per-tenant normals
Not one model for the whole stack.
Regional MSSP · multi-tenant SOC · anonymizedMySoc + SiemCore
“We onboarded 12 new customers last quarter without adding headcount. The AI handles triage and customer reporting—our analysts only see real threats.”
The problem
This MSSP’s growth was capped by the same constraint every managed SOC hits: every new customer means more alerts, more chat, more monthly reports — and another body on the tier-1 rotation.
What was breaking:
- Alert volume scaled with tenants; signal did not
- Analysts burned on false positives that were “normal” for one customer and noise for another
- Customer communication and reporting — the work clients actually judge you on — stole time from investigations
- Hiring ahead of revenue crushed services margin
Why a generic AI layer wasn’t enough
Bolt-on AI on a shared queue fails in multi-tenant life: each customer’s baseline is different. What looks anomalous for Tenant A is Tuesday afternoon for Tenant B.
They needed:
02
A full ops loop
Triage → investigate → tell the customer → report.
03
Sit on the existing SIEM/EDR
Not a rip-and-replace.
The approach
They deployed mysoc.ai as the AI SOC operations layer — alongside their existing SIEM, not instead of it.
01
Connect
New customer environments onboarded in under a day; existing firewalls, EDRs, and SIEM stayed.
02
Understand
SiemCore built a Sphere of Normalcy per tenant — noise dropped before humans touched the queue.
03
Investigate
AI tier-1 enriched and escalated; humans focused on verified threats.
04
Communicate
Notifications, chat, and reporting handled in-product per customer.
05
Improve
Closed investigations tuned that tenant’s baselines.
Results
We publish only the numbers already on the public record for this anonymized customer.
+12
new customers last quarter
0
tier-1 headcount added
Growth decoupled from hiring. Margin looked more like software. Customers still got a SOC that answered them — triage and reporting handled in-product, so analysts only saw real threats.
What they’d tell another MSSP
- 01Don’t automate a shared pile of alerts — automate per-tenant normal.
- 02Keep the SIEM; fix the operations and the customer-facing work.
- 03Measure success as customers per analyst and services margin, not “AI features shipped.”
Ready to scale customers, not headcount?
See how mysoc.ai runs tier-1 for multi-tenant SOCs — cloud or on-prem.