MSSP: the rubric reweighted
A managed security provider running response for many customers on different tool stacks, who needs breadth of integrations, per-customer separation and a defensible record for each client.
7.21D3 Security leads
The ranking
| Rank | Platform | Total | Actions of 25 | Base rank |
|---|---|---|---|---|
| 1 | D3 Security | 7.21 | 19 | 1 |
| 2 | Cyware | 6.20 | 17 | 2 |
| 3 | Splunk SOAR (Cisco) | 6.02 | 19 | 6 |
| 4 | Palo Alto Cortex XSOAR | 5.94 | 20 | 4 |
| 5 | Google Security Operations | 5.83 | 19 | 3 |
| 6 | Swimlane (Turbine) | 5.72 | 18 | 5 |
| 7 | Tines | 5.68 | 22 | 8 |
| 8 | Torq | 5.62 | 13 | 7 |
| 9 | Microsoft Sentinel | 5.03 | 9 | 9 |
| 10 | Prophet Security | 4.94 | 0 | 11 |
| 11 | Dropzone AI | 4.89 | 2 | 10 |
| 12 | Mate Security | 4.84 | 0 | 11 |
| 13 | ServiceNow Security Operations | 4.14 | 7 | 13 |
| 14 | CrowdStrike Falcon Fusion SOAR | 3.44 | 0 | 14 |
A band is a run of neighbouring totals, not a ladder. Bands chain: a new band starts only where the gap to the total above exceeds 0.25, so a band can be wider than 0.25 and the order inside it is not an order. Band groups under these weights: Cyware, Splunk SOAR (Cisco), Palo Alto Cortex XSOAR, Google Security Operations, Swimlane (Turbine), Tines, Torq; Microsoft Sentinel, Prophet Security, Dropzone AI, Mate Security.
Why these weights
Integration depth rises to 15 and deployment and data handling to 10, because a provider must serve many stacks and keep client data apart. Time-to-contain evidence drops to 12 and detection coupling to 5, since the provider usually owns the SIEM. Coverage stays at 25. These are the reweights proposed in rubric.json, recomputed in code, with neighbouring totals no more than 0.25 apart treated as a band. Bands chain: a new band starts only where the gap to the total above exceeds 0.25, so a band can be wider than 0.25 and the order inside it is not an order.
100points in total
Weights against the base rubric
| Criterion | Base weight | MSSP weight |
|---|---|---|
| Native containment coverage | 25 | 25 |
| Published time-to-contain evidence with method | 15 | 12 |
| Approval, rollback and blast-radius controls documented | 15 | 15 |
| Explanation and audit trail | 15 | 10 |
| Integration depth documented | 10 | 15 |
| Detection-to-response coupling | 8 | 5 |
| Pricing transparency | 6 | 8 |
| Deployment and data handling | 6 | 10 |
| Total | 100 | 100 |
The scores are the same as on the home table. Only the weights move. How scores are set.