- Home
- Industries
- Managed service providers
SOC and DFIR backing for MSPs,
behind every client you manage.
Attackers target MSPs because one breach can reach every client. We give you a multi-tenant MSOC with each client in its own isolated tenant, plus the incident responders and forensic examiners to call when something goes wrong.
Why attackers go after MSPs first.
You hold privileged access to many environments, which makes you the most efficient target in the chain.
RMM platform abuse
Remote monitoring and management tools reach every managed endpoint. A compromised admin account can push scripts to the whole client base.
Downstream ransomware
Attackers have used MSP tooling to deploy ransomware to many client environments at once.
Cross-tenant spread
Shared management networks and reused admin credentials let a compromise in one client reach the others.
Targeted phishing of MSP staff
Technicians are phished and password-sprayed because their accounts carry access to every client.
PSA, documentation and backups
These systems hold client credentials, network maps and full copies of client data. Losing them gives attackers the keys.
The obligations you inherit from your clients.
Canadian requirements first, then the frameworks your clients' sectors pass down to you.
| Framework | Who it applies to | What we help with |
|---|---|---|
| PIPEDA and provincial private-sector privacy laws | MSPs handling personal information on behalf of clients | Breach investigation and the facts your clients need for their own notifications |
| Quebec Law 25 | MSPs serving organizations that hold personal information of Quebec residents | Confidentiality incident investigation and documentation for client registers |
| PHIPA (Ontario) | MSPs acting as electronic service providers to Ontario health information custodians | Safeguards assessment, access logging and incident investigation |
| OSFI Guideline B-10, third-party risk | Applies to federally regulated financial institutions, which pass requirements to their MSPs | Evidence that satisfies a bank client's vendor assessment |
| Critical Cyber Systems Protection Act (Bill C-8, Royal Assent June 2026, not yet in force) | Critical-sector operators, once designated, who must manage cyber risk in the suppliers they rely on | Monitoring and incident readiness that supports your clients' programmes |
| SOC 2 | MSPs whose clients or insurers require independent assurance of controls | Readiness assessment and ongoing control evidence through Forseti |
| HIPAA | Canadian MSPs serving US healthcare clients as business associates | Security risk analysis and breach investigation |
One service, every client kept apart.
Isolated tenants
Each client runs in its own MSOC tenant, so detections, data and response actions never cross between clients.
Your stack or ours
Overlay works with the tools you already manage. Complete brings everything from us. Run either fully autonomous or human-in-the-loop.
Responders on call
When an incident needs hands, our incident responders and Bifrost forensic examiners step in for you and your client.
How we back managed service providers.
MSOC
A multi-tenant autonomous SOC with isolated tenants, detecting and containing threats in under two minutes across your client base.
Learn more →IR retainer
Pre-agreed terms and guaranteed response from four hours down to one for incidents in your environment or your clients'.
Learn more →BifrostDigital forensics
What happened, how and when, documented to a standard insurers, regulators and courts accept.
Learn more →Threat hunting
Proactive hunts across client tenants for the activity that slips past automated detection.
Learn more →RagnarökPenetration testing
Test your RMM, management network and tenant isolation before an attacker does.
Learn more →Partner network
Join the Mjolnir partner programme to bring our SOC and DFIR teams to the clients you manage.
Learn more →What buyers ask.
How do you keep our clients' data separate?
Each client runs in its own isolated MSOC tenant. Detections, data and response actions stay inside that tenant.
We already run our own tools. Do we have to replace them?
No. The Overlay model works with the stack you manage today. Complete is there if you want everything from us.
What happens when one of our clients has a real incident?
MSOC contains what it can inside the boundaries you set, and our incident responders and forensic examiners take it from there with you.
How do we work with you?
Through the partner network. Talk to us about the clients you manage and we will scope the right model.
Talk to us about backing your clients.
Put a specialist on a call to scope multi-tenant MSOC, response and forensics for the clients you manage. No charge, no commitment.