Go to market // MSP-native
Estates, not endpoints.
WARDOG's tenancy model was designed from the hierarchy service providers actually operate: distributor, MSP, customer, site, then endpoints and identities. Policy, authority and evidence inherit down that structure.
distributor → msp → customer → site → endpoint
Sample / demonstration data| Customer | Sites | Endpoints | Security state | Needs analyst | Verified closures |
|---|---|---|---|---|---|
| Northgate Legal | 4 | 610 | Stable | 0 | 12 |
| Halden Manufacturing | 9 | 2,140 | Contained | 1 | 31 |
| Ferris Clinical | 2 | 275 | Stable | 0 | 6 |
| Orrin Logistics | 12 | 3,320 | Verifying | 2 | 44 |
Operating model
Analysts supervise, they don't triage.
The constraint on provider growth is analyst attention. WARDOG is built to spend that attention on decisions that genuinely need judgement.
Outcome queues
Analysts see verified incidents and pending authority decisions — not a stream of raw events to classify.
Inherited policy
Baselines set at MSP level flow to customers and sites, with documented per-tenant deviation.
Scoped authority
Autonomy level is a per-tenant decision. Some customers authorise containment; others require an analyst at every action.
Portfolio state
Security state is expressed per customer, so posture conversations are evidence-based rather than anecdotal.
Evidence on demand
Every closed incident already carries the record a customer, insurer or auditor would ask for.
Isolation by construction
Tenant boundaries are enforced at the authority layer, not by convention in a shared console.
Commercial shape
Defensible service, not more headcount.
Providers are asked to deliver 24/7 outcomes at prices that don't support 24/7 human triage. Automation only resolves that tension if it is trustworthy enough to leave running.
Why authority matters commercially
A provider can only delegate to automation it can explain. Deterministic authority, bounded blast radius and verified proof are what make delegation defensible to the customer whose production estate is being contained.
Partner with us early
We are working with a small group of providers to shape deployment, policy defaults and reporting. If you run a security practice, we'd like to hear how you operate.