Case Studies / The MSSP
From cost centre to revenue line: tailored threat intelligence for 30 customers, without hiring a team.
A managed security services provider in the UAE · Regional MSSP · Service delivery and commercial leadership
Use case
White-label, per-tenant threat intelligence delivered as a paid managed service.
Goal
Turn threat intelligence from a resource drain into a service the MSSP can sell, price and scale.
Challenge
Delivering tailored intelligence per customer meant analysts, data subscriptions, tooling and training the economics could not carry, so customers got generic reports that fitted nobody.
Solution
Liberty91 runs a dedicated set of agents per customer organisation, produces tailored intelligence under the MSSP's own brand, and records every delivery end to end.
The challenge.
This MSSP's customers were asking for threat intelligence. Their insurers expected it, security questionnaires probed for it, and competitors were beginning to list it. The provider knew the demand was real; the problem was the delivery model. Doing tailored reporting properly for one organisation is a stretch. Doing it for every customer meant hiring a team, buying the data, buying a platform and training the analysts, and the numbers did not work. The compromise, as it so often is, was a generic periodic report sent to everyone. It ticked a contractual box and applied to no one in particular, and the team knew it.
What changed.
With Liberty91, each of the MSSP's customers gets its own set of AI agents, trained on that customer's sector, region, technology, suppliers and profile. There are no shared, general reports: what customer A receives is built from customer A's threat picture, and customer B's from theirs. The service ships under the MSSP's brand end to end. Reports and alert emails carry their templates, their logos, their sender name. The analysts they already have oversee intelligence for many customers rather than a few, reviewing and approving what goes out rather than researching and writing each report from scratch. And every report, indicator list and detection rule sent to a customer is recorded in a Sent log: what went out, when, to whom, and whether it delivered. That log is what the MSSP brings to a quarterly review, a renewal, or an audit of what the contract says they deliver.
The result.
Threat intelligence became a priced, sellable service line instead of a cost centre. Tailored, relevant, per-customer intelligence replaced the generic report, the service scaled without building a team or a platform, and delivery is provable from beginning to end.
30
Customer organisations receiving tailored intelligence under the MSSP's own brand within the first two quarters.
Under a week
Time to bring a new customer live with their own dedicated agents, from kickoff to first delivered product.
2
Analysts overseeing the entire service, reviewing and approving rather than researching and writing.
“Intelligence used to be the thing we struggled to justify internally. Now it is a line on the invoice, and the renewal conversation starts with the Sent log.”
Head of Service Delivery, a managed security services provider in the UAE
Evidence gathered through a customer interview, 2026. The customer has asked not to be named; role and organisation verified by Liberty91.
Run the numbers against your own accounts.
More case studies.
The analyst team
How a UAE energy major's threat intelligence team went from manual collection and days of delay to briefing leadership before anyone else raises it.
Risk and controls
How a UK insurer connected live threat activity to its assets, suppliers and controls, and fed the gaps straight into its security investment plan.
The CISO
How a large UK bank replaced an expensive CTI programme that had no capacity left for analysis with intelligence its stakeholders act on, from day one.
Premium intelligence, operationalised
How a UK financial services group turns CrowdStrike and Google Threat Intelligence reporting into organisation-specific assessment and action.