MSSP & Enterprise
ThreatMap Enterprise turns our intelligence API into the platform MSSPs build managed detection services on. Multi-tenant, white-label, OEM-ready.
Building an MDR product? ThreatMap is the intel layer. You own the customer relationship, the portal, the SLA. We power the intelligence behind it. Become a partner →
What MSSPs get
| Capability | What it means |
|---|---|
| Multi-tenant architecture | One parent account manages unlimited customer tenants. Each tenant: isolated IOCs, projects, alerts, users, audit logs, credit allocation. |
| White-label portal | Customer portal at security.your-mssp.com (your CNAME). Your logo, your colors, your domain. No ThreatMap branding visible. |
| Per-customer incident management | Every tenant gets a full IR portal — triage queue, case management, evidence chain, playbooks. |
| Push-once, deploy-many | Publish a detection rule, monitor, or playbook once and roll it to all tenants, a subset, or one customer. |
| Cross-tenant visibility | MSSP admins see alerts, incidents, and posture across every customer in one console. Filter, sort, drill-in. |
| Per-tenant credit allocation | Set monthly credit caps per customer. Or let customers BYOK their own feeds. Full margin control. |
| Per-team MCP endpoints | Each tenant gets its own MCP endpoint with per-tool ACLs. Customer AI agents get scoped intelligence. |
How tenant lifecycle works
# Create a new customer tenant curl https://api.threatmap.io/v1/tenants \ -H "Authorization: Bearer $MSSP_KEY" \ -d name="Acme Corp" \ -d plan="full-service" \ -d credits_monthly=50000 # Configure white-label portal curl https://api.threatmap.io/v1/tenants/tnt_acme/branding \ -H "Authorization: Bearer $MSSP_KEY" \ -d cname="security.acme.your-mssp.com" \ -d logo_url="https://your-mssp.com/logo.png" \ -d primary_color="#0a2540" # Add an MSSP analyst to the tenant curl https://api.threatmap.io/v1/tenants/tnt_acme/users \ -H "Authorization: Bearer $MSSP_KEY" \ -d email="analyst@your-mssp.com" \ -d role="lead-responder" # Push a detection rule to ALL tenants curl https://api.threatmap.io/v1/rules/deploy \ -H "Authorization: Bearer $MSSP_KEY" \ -d rule_id="c2-beaconing-2026q3" \ -d scope="all_tenants"
White-label details
| Feature | Details |
|---|---|
| CNAME | Customer accesses portal at your domain (e.g., security.acme.com). DNS is yours. |
| Branding | Your logo, your colors, your email-from address. No ThreatMap branding. |
| Login | SSO via your identity provider, or ThreatMap-hosted auth under your brand. |
| Terms | Show your own MSA, privacy policy, SLA in the customer portal. |
| Self-service vs full-service | You choose per customer: full-service (your analysts handle everything) or co-managed (customer works alongside you). |
Per-customer incident portal
Every tenant gets the same IR console a direct enterprise customer gets:
- Alert triage queue — severity-sorted, one-click pivot into IOCs.
- Case management — assign owner, track status, comments, evidence.
- Evidence chain-of-custody — every artifact hashed, timestamped, preserved.
- Playbook-driven response — trigger IR playbooks; customers see step-by-step progress.
OEM pricing model
| Model | How it works |
|---|---|
| Per-call (credit model) | MSSP pays ThreatMap per credit consumed across all tenants. Volume discounts above 1M credits/month. |
| Per-customer flat | MSSP pays a fixed amount per active tenant per month. Predictable cost; easy to mark up. |
| Revenue share | MSSP resells ThreatMap as part of their MDR package. Revenue split negotiated per partnership. |
Typical MSSP contracts: $100K+/year depending on tenant count and volume.
Enterprise deployment options
| Option | Best for | Data residency |
|---|---|---|
| Shared cloud (default) | Most enterprises | Region-selected (US/EU/APAC) |
| Single-tenant cloud | Regulated industries | Dedicated infrastructure |
| On-prem | Air-gapped networks | Never leaves your network |
| Air-gapped | Government, defence | Fully isolated, portable updates |
On-prem deploys as a single Docker Compose stack or Kubernetes manifest. All dependencies (RelataDB, Next.js, API gateway) run locally. Updates delivered as portable images.
How to become an MSSP partner
- Email partners@threatmap.co
- Technical integration call (1 hour) — review API surface, tenant model, white-label setup
- Sign OEM agreement (revenue share or per-call)
- Provision your parent account + first 3 tenants
- Go live — typical timeline: 2-4 weeks
Why MSSPs choose ThreatMap: Building a multi-tenant MDR platform from scratch takes 12-18 months and millions in feed licenses. ThreatMap delivers it day one, white-labelled, at $50-100K/yr — the cost of one security engineer.