Security Delivery Platform

ContraForce Agentic Security Delivery Platform for Service Providers

ContraForce is the multi-tenant Agentic Security Delivery Platform. Security Delivery Agents drop into your live Microsoft Defender and Sentinel practice and run the full delivery loop: triage, investigation, containment, and customer reporting. Take on more customers without hiring an analyst for every queue.

Built natively on Microsoft Azure. Agents work inside the customer's own tenant against Microsoft Defender XDR, Microsoft Sentinel, and Microsoft Entra ID. Gamebooks encode your standard operating procedures, and a human approves consequential actions before they run.

AI that acts. Humans who decide.

What's included

• Microsoft Defender XDR, Defender for Endpoint, and Entra ID modules
• Microsoft Sentinel module (optional: Defender XDR-only practices fully supported)
• Multi-EDR support for other telemetry via API
• Unlimited Security Delivery Agents
• Agent Center, Gamebook Engine, and Content Management System

The delivery loop

• Triage. Classify and deduplicate every alert the moment it lands.
• Investigation. Assemble a decision-ready case from Defender, Sentinel, and Entra ID.
• Containment. Stage the response, then pause for human approval.
• Reporting. Execute approved actions, write the report, open the PSA or ITSM ticket.

Benefits for providers

• Take on more customers without adding an analyst for every queue
• 5x analyst capacity, 62-second mean time to response, 100% of alerts worked
• Cost per incident under $1. Shift delivery economics from labor to compute.
• Deploy in under an hour through delegated, least-privilege Entra access
• Gamebooks keep delivery consistent; humans approve every consequential action
• Flexible Foundry billing: bring your own Azure cloud or run on the ContraForce cloud

Get started

Connect one workspace. See what happens on the first alert. Book a working session at contraforce.com.