The managed security market is changing fast. Clients expect more — more visibility, faster response, clearer evidence for their insurers — while MSPs are being asked to deliver it without hiring an army of analysts. Here is how ARRAC changes that equation.
There is a gap in the managed security market that nobody talks about directly, but every MSP feels. Clients want enterprise-level security outcomes. They want rapid incident response, compliance evidence, continuous monitoring, and someone who can explain their posture to their cyber insurer. What they are willing to pay rarely covers the cost of the people needed to deliver it.
Hiring a dedicated SOC analyst costs between £45,000 and £65,000 per year before employer costs — and one analyst cannot cover 24 hours a day, seven days a week. A properly staffed security operations function, even a minimal one, requires multiple people operating in shifts. For most MSPs managing a portfolio of SME clients, that cost cannot be passed on at the per-client prices the market will bear.
The result is a pragmatic compromise most MSPs make quietly. You monitor what you can, respond when you can, and hope the alerts you miss are not the important ones. It works until it doesn't.
"One analyst cannot monitor 12 client tenants simultaneously at 3am on a Tuesday. An autonomous platform can."
ARRAC connects to a client's Microsoft 365 tenant through a standard admin consent flow — the same type of OAuth grant your clients use when they add any business application to their environment. Once connected, ARRAC reads signals continuously from Entra ID, Exchange Online, Microsoft Defender, Purview, and Azure ARM. It does this for every connected tenant simultaneously, at all hours, without variation in attention or quality.
The platform is not an alert aggregator that sends you more things to look at. It is an investigation engine. When something anomalous happens — a suspicious sign-in, an unusual OAuth app consent, a pattern of behaviour that matches known attack techniques — ARRAC investigates it. It pulls correlated signals, maps them to MITRE ATT&CK techniques, assesses confidence, and either recommends an action or executes one, depending on what autonomy tier the client has configured.
By the time an alert reaches an analyst, it is not raw telemetry. It is a structured finding: what happened, what it means, what was done, and what still needs human decision. That is a fundamentally different workload from watching a stream of events and deciding which ones matter.
MSPs access ARRAC through a dedicated partner console — a unified view across all managed client tenants. From a single interface you can see the security posture of every client, active incidents across the portfolio, containment actions that have been taken or are pending review, and compliance status against CIS, Cyber Essentials Plus, and ISO 27001 frameworks.
Each client in the console is independently scoped. You see your clients' data; you cannot see another MSP's clients. Client security data is completely isolated at the infrastructure level — not just a UI filter but a server-side data boundary. This matters both for data protection compliance and for conversations with clients who ask how their information is handled.
ARRAC operates on a tiered autonomy model. Each client tenant is configured at one of four tiers:
As the MSP, you configure the autonomy tier for each client — and you do so with the client's explicit consent and understanding of what each tier means. The configuration should reflect each client's own risk tolerance, not just what is operationally convenient for your team.
The practical effect for an MSP portfolio is that you can operate clients at different tiers based on their maturity, their appetite for autonomous action, and the sensitivity of their environment. A professional services firm handling client-sensitive data might sit at Tier 2. A logistics company that has had incidents before and understands the platform might run at Tier 3. You manage the policy; ARRAC executes it.
One of the practical shifts in the SME market over the past two years is the role cyber insurance is playing in security conversations. Insurers are asking harder questions at renewal. Clients are receiving questionnaires about MFA coverage, privileged account management, incident response capability, and vulnerability management. Some are finding their premiums increasing or their cover narrowing because they cannot demonstrate adequate controls.
ARRAC's Virtual CISO module addresses this directly. It generates insurance readiness reports — assessments of the controls insurers typically scrutinise, presented in a format that can be given to an insurer or broker. It maintains an evidence vault: an immutable record of security assessments, findings, and actions taken. When a client needs to demonstrate that they detected and responded to a specific incident, the audit log exists and cannot be altered.
For MSPs, this creates a tangible differentiator. You can have a conversation with a prospective client about what their current insurer is asking for and demonstrate precisely how ARRAC addresses those requirements. That is a different sales conversation from explaining features.
It is worth being direct about the boundaries. ARRAC is not a substitute for a security team — it is a force multiplier for one. It handles the continuous, high-volume, machine-speed work that humans cannot sustain: monitoring every sign-in event, correlating telemetry across identity and email and cloud simultaneously, executing containment within seconds of detection at 3am on a Sunday.
What it does not do is make judgement calls about business context, handle client relationships, conduct forensic investigations of complex incidents, provide legal or regulatory advice, or replace the knowledge an experienced security engineer brings to architecture decisions. Those remain human work.
The MSPs who get the most from ARRAC are the ones who understand this clearly — who use the platform to handle the surveillance and initial response work, freeing their experienced people to focus on the investigations, client conversations, and strategic engagements that actually require human expertise.
ARRAC bills MSPs on a per-tenant wholesale basis. The commercial relationship is between ARRAC and the MSP — your client pricing is entirely your own decision. All ten platform modules — including Windows endpoint protection — are included for every connected tenant. There is no per-module licensing and no feature gating — every client gets the full platform.
If you are evaluating ARRAC for your MSP practice, the most useful starting point is connecting a single test tenant and running through a real scan. The platform becomes concrete very quickly once you can see what it finds in an actual Microsoft 365 environment rather than a demonstration environment with carefully selected data.
Connect a test tenant and run a real scan. No staged demos.