XSOAR migration for MSSPs: keep your margin, keep your clients’ stacks
Most MSSPs bought Demisto for vendor-neutral orchestration and have renewed through Cortex XSOAR ever since. With Palo Alto naming Cortex AgentiX as XSOAR’s next generation, licensed per user with metered compute units, a service business built on fixed-price contracts has a decision to make. D3 Morpheus gives MSSPs an agentic SOC at one predictable cost per alert, migrates playbooks client by client, and never asks a client to change their SIEM, EDR, email security, identity provider, Jira or ServiceNow.
The MSSP’s problem with the successor’s economics
Your product is neutrality. Thirty clients, thirty stacks, one orchestration layer that works across all of it. That’s what you sell, and it’s why you bought Demisto in the first place. A suite is built to consolidate one customer onto one vendor. Your business runs the other way.
Then there’s the meter. Per Palo Alto’s documentation, AgentiX is licensed per user per year (Base includes 2 users, Enterprise 4), compute units are consumed by XQL queries and “queries called without enough quota will fail,” retention past six months is sold in 31-day add-ons, and agent/LLM usage “does not consume compute units at this time.” You sell fixed-price services. Quoting a three-year client contract on top of licence components you can’t forecast is margin roulette.
Multi-tenancy will presumably arrive; it’s table stakes. The question isn’t whether; it’s on what terms. Before you renew, get the service-provider terms in writing: how analysts and client environments are counted, what the meter does to your cost per alert, and the playbook migration path. Those answers set your margin for the next three years.
The Morpheus MSSP model
| What your business needs | How Morpheus answers it |
|---|---|
| A platform cost you can quote services on | One capped annual price sized to alert volume, seats included, overage published at $0.97 per event above capacity. Cost per alert becomes arithmetic you can build fixed-price contracts on. |
| More clients per analyst | Up to 95% of alerts triaged and L2-investigated in under two minutes. Every client’s alert gets a full read-only investigation (attack path, MITRE mapping, blast radius, drafted remediation) before an analyst opens it. Growth without hiring. |
| Different clients, different risk appetites | Autonomy set per client and per alert type across four modes, from fully deterministic to autonomous, each reversible. One client stays deterministic, another runs AI-led. Same platform. |
| Neutrality across every client stack | 800+ self-healing integrations across whatever each client runs: Splunk, Sentinel, QRadar, Elastic, Google SecOps; CrowdStrike, Defender, SentinelOne, Cortex XDR; Proofpoint, Microsoft 365; Okta, Entra ID; Jira, ServiceNow. 18-minute production MTTR when a vendor breaks an API, versus the 4–6-week industry norm. |
| Fast client onboarding | The same conversion pipeline that migrates your XSOAR content becomes your client-onboarding harness: new client, mapped integrations, converted playbooks. |
| Evidence your clients’ auditors accept | Every action tiered by command risk and approval-gated; one audit trail per incident across all autonomy modes; governance mapped to SEC 1.05, NYDFS 500, HIPAA, NIS2, DORA and EU AI Act Article 14. |
How the migration works for a service provider
- Readiness report, free. Export your XSOAR content bundle. We return the inventory across your client environments, every playbook tagged migrate, simplify, retire, or agentic. No meeting required.
- Conversion with proof. D3 converts playbooks, incident configuration and client reporting with a side-by-side diff per playbook. We replay your closed incidents and hand you a parity report.
- Parallel run, client by client. Morpheus runs beside XSOAR on live alerts. You cut over one client at a time, on your written sign-off. XSOAR stays on until you switch it off.
- No double payment. Under the XSOAR Exit Program, billing starts when your XSOAR contract ends, and year one lands at or under your current XSOAR line.
MSSPs have already completed the XSOAR-to-Morpheus move. References available under NDA.
Start with the free readiness report
Tell us your XSOAR version and renewal quarter. We return the inventory and the migrate / simplify / retire / agentic map. No commitment, and no meeting required.
The form did not load. Send your XSOAR version and renewal quarter to morpheus@d3security.com and we will return your readiness report.
Prefer email? Send your XSOAR version and renewal quarter to morpheus@d3security.com. Or skip the report and book a two-day evaluation on your own alerts.
Frequently asked questions
Can an MSSP run fixed-price services on consumption-based platform pricing?
Only by carrying the forecast risk yourself. If the platform bills per user plus metered compute units, your cost per alert moves while your client price doesn’t. A capped annual platform price with published overage rates keeps cost per alert stable enough to quote fixed-price contracts against.
What should an MSSP get in writing before renewing Cortex XSOAR?
Three things: the successor’s service-provider licence terms (how analysts and client environments are counted under per-user pricing), what compute-unit metering does to your cost per alert and fixed-price contracts, and the playbook migration path with a compatibility statement. Price your next three years of services against those answers.
How does an MSSP migrate from XSOAR to D3 Morpheus?
D3 converts your playbooks, incident configuration and client reporting with a per-playbook diff, replays your closed incidents for a parity report, runs beside XSOAR on live alerts, and cuts over client by client on your written sign-off. Under the XSOAR Exit Program, migration is included and billing starts at your XSOAR contract end.
Can different clients run different autonomy levels on Morpheus?
Yes. Autonomy is set per client and per alert type across four modes (Deterministic, AI-Assisted, AI-Led, Autonomous) and each setting is reversible. A regulated client can stay fully deterministic while another runs AI-led triage on the same platform.
Do my clients have to change their SIEM, EDR or ticketing?
No. Morpheus connects to each client’s existing stack (Splunk, Sentinel, QRadar, Elastic or Google SecOps; CrowdStrike, Defender, SentinelOne or Cortex XDR; their email security, identity provider, Jira and ServiceNow) through 800+ self-healing integrations. Nothing in the client’s environment moves.
How does Morpheus pricing work for an MSSP?
One capped annual subscription sized to alert volume, with analyst seats and an allocation of full investigations included, and overage published at $0.97 per event above capacity. Service-provider commercial terms are stated in the order form. There are no credits, tokens or query quotas.
Sources
- Palo Alto Networks press release, Oct 28, 2025: Cortex AgentiX named “the next generation of Cortex XSOAR.” paloaltonetworks.com
- Cortex AgentiX documentation: “Understand Cortex AgentiX licenses” (per-user licence, Base/Enterprise compute-unit quotas) and “Data retention policy” (six-month default, 31-day add-ons), retrieved Aug 27, 2026. licences · data retention
- Palo Alto Networks End-of-Sale announcements: XSOAR professional-services SKUs, Feb 1, 2026. paloaltonetworks.com
Cortex, XSOAR, XSIAM and AgentiX are trademarks of Palo Alto Networks, Inc. All other marks belong to their owners. D3 Security is not affiliated with Palo Alto Networks. Competitor information reflects public documentation on the retrieval date and may change.