The scaling problem every MSSP eventually hits
A managed security provider's growth is normally bounded by one thing: how many customer environments a given analyst headcount can competently monitor. Sales can bring in a new customer faster than the SOC can safely onboard one, because onboarding a new tenant does not just add revenue — it adds investigation volume, and investigation volume scales with analyst hours, not with software licences. Past a certain point, the honest answer to "can we take on another customer" becomes "not without hiring," and hiring experienced SOC analysts is slow and expensive across the whole industry right now, not just for any one provider.
The following is a worked illustration of where the constraint typically bites, not a case study from a named customer — treat the specific figures as modelled rather than measured, in the same way the outcomes on urgentic's results page are modelled from the platform's own performance rather than pulled from a customer survey.
Where the constraint actually shows up
It rarely shows up as a hard "no." It shows up as service quality quietly degrading as tenant count rises — investigation times stretching, second-shift coverage getting thinner, escalation SLAs surviving on paper but not in practice. By the time it becomes visible to customers, it has usually been building for a while.
What changes when investigation is autonomous per tenant
urgentic investigates every alert per tenant, isolated from every other tenant's data and configuration, completing each investigation in under three minutes regardless of how many other customers are being served concurrently. Because the constraint that used to scale with tenant count was analyst attention, and that step is now automated, taking on another customer stops requiring a proportional increase in analyst headcount to maintain the same investigation depth.
This does not remove analysts from the picture. It changes what they spend their time on — escalation decisions, customer-specific tuning, the genuinely ambiguous cases that benefit from a person's judgement — rather than the first-pass evidence-gathering that autonomous investigation now handles per alert, per tenant, continuously.
What this means for the underlying economics
In a services business where headcount cost scales with the work delivered, decoupling investigation depth from analyst headcount is what improves margin — not by cutting corners on any one customer's coverage, but by removing the requirement to add a person for every additional tenant added. The realistic range of improvement varies enormously by an MSSP's existing tenant mix, alert volume per customer, and how much of their current cost base is analyst time versus tooling and overhead; anyone quoting a single universal number for "how much this saves" is guessing. What is consistent is the direction: the ceiling that used to be set by headcount moves, and it moves without asking a provider to compromise on how thoroughly each customer's alerts get investigated.