Field notes / MSSP
The questions MSSPs ask us about AI SOC. Ranked.
We talk to managed service providers about AI in the SOC every day, and the same questions keep coming up. Eight of them dominate. Here they are, ordered by how often they’re asked, with what each one is really about. If you’re evaluating this category, it’s a ready-made checklist.
01
“How does the pricing model work?”
100% of MSSP conversations
The only topic that comes up every single time, often more than once. The real question underneath: is it per-client, per-alert, or per-seat, and does the license bill grow at the same rate as the client roster. For an MSSP, a pricing model that scales with every new logo is a squeeze on your business, and it tightens with every client you win.
02
“Does it work with our clients’ stacks?”
95% of MSSP conversations
MSSPs run across dozens of client environments with different SIEMs, EDRs, and email security. The question isn’t whether one integration exists. It’s whether the platform holds up across every combination in your portfolio, and what happens when a new client shows up with something unusual.
03
“Is the multi-tenancy real?”
90%+ of MSSP conversations · usually in the first 15 minutes
The earliest question in almost every conversation, and the one MSSPs double-check most carefully. They want complete client data segregation, aggregated and per-client views, and per-tenant configuration, because they’ve seen “multi-tenant” mean a separate instance per client.
“By multi-tenancy, you mean that we can define multiple tenants in your portal itself, by separating out our clients, correct?”
MSSP evaluating Morpheus
04
“Can we grow without hiring?”
85% of MSSP conversations
The core economic question. Alert volume climbs with every client you onboard, and if the only answer is more analysts, your revenue per analyst never improves. MSSPs ask this as a margin question, not a features question.
“We have around 30 customers right now in our SOC… we want to open now to at least every SIEM in the right upper corner of the Gartner quadrant.”
MSSP prospect, on growth plans. The platforms they had in mind: Microsoft Sentinel, Splunk, Google SecOps, Exabeam, Securonix, Gurucul — all integrate with Morpheus.
05
“What does it do about alert volume?”
80% of MSSP conversations
High alert volumes multiplied across every client tenant. MSSPs ask about deduplication, correlation, and false-positive reduction before the alerts ever reach an analyst, because noise is a cost you pay every single day.
06
“Can our clients see our brand, not yours?”
60% of MSSP conversations
White-labeling, client portals, and customer-facing reporting. You sell a service under your own name. The platform needs to disappear behind it.
“We’re trying to work out if we can leverage this for all of our customer-facing comms… we need a ticketing platform that we’re a bit more in control of.”
MSSP evaluating Morpheus
07
“How is this different from…?”
55% of MSSP conversations
Most MSSPs are evaluating two or three vendors at once, and the comparison comes in two distinct flavors. They have different answers, and knowing which one you’re asking is half the evaluation.
“…from Tines and Torq?”
The hyper-automation platforms. They pair a workflow builder with an AI assistant, and an engineer still designs the playbook for every tenant and every alert type. The real question: does the AI help you build the automation, or does it run the investigation itself?
“…from Dropzone, Prophet, and 7AI?”
The AI triage tools. They position themselves around investigating the alert, then hand the findings to whatever handles response. The real question: what happens after triage, and how many platforms does the answer involve?
08
“Where does the data live?”
~40% of international MSSP conversations
MSSPs serving Europe, Australia, and other regions with residency requirements ask about in-country storage and regional hosting early, because it’s a qualification issue for their own regulated clients.
“Do you store data in country or out of country? They specifically asked, do you store things out of country?”
MSSP prospect relaying a client requirement
Where the demo turns
Early conversations are about risk. Demos are about proof. These are the four moments where MSSP and MDR audiences consistently lean in.
Moment 01
The tenant dropdown
Switching between aggregated and per-client views from a single dropdown, with full data segregation underneath. It answers the first-15-minutes question visually, in one click.
Moment 02
The playbook that builds itself
Morpheus takes the alert and generates the investigation. Prospects comparing us against agentic assistants notice the difference immediately: nobody scripted this first.
Moment 03
Watching the reasoning
Demo audiences ask to see the attack path and the actual queries the AI ran. Morpheus shows both. Teams that have watched other AI tools fail to pull the right telemetry check this hardest.
Moment 04
Per-tenant control
Service providers ask to control how investigations run and to set procedures per tenant. Autonomy in Morpheus is a per-tenant setting, not a platform-wide switch.
Our answers, in one place
Since these are the questions, here is where Morpheus stands on each. Short versions; the demo covers the rest.
Pricing model
Annual subscription with analyst seats and a tiered alert-volume envelope. D3 absorbs all AI token costs, so the number finance signs is the number finance pays.
Client stacks
Morpheus works across your existing security stack, and across your clients’ stacks. Integrations are maintained for you, so a new client’s toolset is a configuration task, not an engineering project.
Multi-tenancy
Native multi-tenancy with full client data segregation, aggregated and per-client views, and independent per-tenant configuration in a single instance.
Growth without hiring
Morpheus runs L1 and L2 investigation end to end, with up to 95% of alerts triaged and investigated in under two minutes at L2+ depth. You control what it’s allowed to do.
Alert volume
Deduplication, correlation, and autonomous triage happen before an analyst sees anything. Your team works the small fraction that needs human judgment.
White-label
Client-facing views and reporting carry your brand. Your clients see your service, not our platform.
vs. Tines, Torq, and the triage tools
The automation platforms still need an engineer to design the playbook. The triage tools stop after triage. Morpheus generates the investigation from the alert and carries it through response orchestration and case management, on one platform.
Data residency
Regional hosting options, including EU data centers, to meet in-country requirements for you and your regulated clients.
Ask us all eight on one call.
Book a multi-tenant walkthrough. Bring your client list, your stack list, and your hardest question. That’s what the first 15 minutes are for.
Percentages are estimates of how often each topic comes up in D3 Security’s conversations with MSSP prospects, 2026. Quotes are anonymized and lightly edited, with identifying details altered to protect the speaker. Competitor characterizations reflect their public product positioning. D3 Security · Morpheus AI SOC Platform · [email protected]