ContraForce
ContraForce builds an Agentic Security Delivery Platform for MSSPs, MSPs, and security operations teams running Microsoft Sentinel and Defender XDR. Autonomous AI agents automate 95% of incident triage, investigation, and response, with Gamebooks enforcing SOPs across customer tenants at $249/month entry pricing.
- Company typePrivate
- Founded2021
- HeadquartersMckinney, United States
- Headcount11–50
- GTM typeB2B
- OfferingSoftware
What ContraForce does
ContraForce is a private cybersecurity company headquartered in Frisco, Texas with a London office, founded in 2021 by CEO Stan Golubchik and CTO Ricky Melendez. The company builds an Agentic Security Delivery Platform purpose-built for MSSPs, MSPs, and security operations teams running Microsoft Sentinel and Microsoft Defender XDR. The platform is composed of two core components: Security Delivery Agents, which are autonomous AI agents that perform incident triage, investigation, evidence gathering, enrichment, documentation, and response execution across unlimited customer tenants; and Gamebooks, an SOP enforcement engine that turns standard operating procedures into governed workflows with human-in-the-loop approval gates, audit trails, and automated MITRE ATT&CK mapping. The platform uses a federated access architecture that operates inside customer Microsoft tenants without log duplication or data custody, addressing the #1 operational pain point in multi-tenant MSSP environments: SOP variance and linear cost scaling as customer count grows.
ContraForce distributes through three GTM motions: product-led growth via a 14-day free trial (250 investigations, up to 10 workspaces, no credit card required); direct sales via demo booking and enterprise custom pricing; and channel partners (MSSPs and MSPs) who resell managed security services built on the platform. The platform is listed on Microsoft Marketplace, and ContraForce is a Microsoft ISV partner, MISA member, and Microsoft Pegasus Startup alumnus (Microsoft Security ISV of the Year 2024). Two deployment models exist: ContraForce Cloud (ContraForce-hosted, $249/month plus pay-as-you-go investigations) and Your Cloud (self-hosted in customer Azure subscription with flat per-workspace licensing, 10-workspace minimum, volume discounts).
The company has raised approximately $3.725M in total funding ($475K Y Combinator in 2021 and a $3.25M seed round co-led by Gallos Ventures and DataTribe in October 2024). At the time of the seed round, ContraForce reported 400% year-over-year ARR growth and serves customers across 15+ countries, with named MSSP customers including Acora, Zirilio, GCS Technologies, Bulletproof, DYOPATH, and Abra. Recognitions include SOC 2 Type II certification, CyberSecurity Breakthrough Award 2025, SC Awards 2024, and Microsoft Security Excellence Awards finalist positions in 2024, 2025, and 2026.
ContraForce firmographics
Firmographics- Name
- ContraForce
- Legal name
- ContraForce Group, Inc.
- Website
- https://contraforce.com
- Company type
- Private
- Founded year
- 2021
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- ContraForce builds an Agentic Security Delivery Platform for MSSPs, MSPs, and security operations teams running Microsoft Sentinel and Defender XDR. Autonomous AI agents automate 95% of incident triage, investigation, and response, with Gamebooks enforcing SOPs across customer tenants at $249/month entry pricing.
- Ownership category
- akta.pro rank
ContraForce industry classification
Industry- Product category
- Security Operations / SOC Automation Software
- NAICS
- Software Publishers (513210), Security Systems Services (except Locksmiths) (561621)
- SIC
- Services-Prepackaged Software (7372), Services-Computer Integrated Systems Design (7373)
- akta.pro primary industry
- Endpoint Security Managed Services (EDR/XDR) (BPAEADAH)
- akta.pro secondary industries
- Extended Detection & Response (XDR) (HDADAEAB), Responsible AI, Security & Privacy Platforms (Safety, Guardrails, PII) (HDAEANAG), Data Security & Privacy for Cloud (DLP, DSPM, Tokenization) (HDABAHAK)
Keywords
Where ContraForce is headquartered
LocationHeadquarters
- HQ city
- Mckinney
- HQ country
- United States
- HQ region
- North America
Offices2 records
Markets served
ContraForce business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Technology or R&D, Personnel, Marketing or Sales, Infrastructure, Operations
Revenue model
- ContraForce Cloud - Platform Subscription: Monthly platform subscription that includes unlimited Security Delivery Agents, Gamebook Engine, EDR integrations, Microsoft Sentinel integration, ticketing integrations, full audit trail and reporting, and REST/webhook APIs. Plans step up by included workspaces. Starts at $249/month.
- Pay-as-you-go Investigations: Investigations bill flat per run - one Security Delivery Agent run for a single security incident. Pay as you go with no bundles, no included runs, no overage tiers. This is consumption-based revenue on top of the platform subscription.
- Your Cloud - Workspace Licensing: Flat per-workspace licensing for self-hosted infrastructure deployed in customer's Azure subscription. Automatic volume discounts apply as workspace count grows. Requires 10-workspace minimum. Azure infrastructure billed separately by Microsoft.
- Enterprise Custom Pricing: Custom workspaces and commercial terms for organizations needing high-volume workspace licensing. Contact sales for Enterprise quote.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Hybrid | Monthly | ContraForce Cloud - Starter Plan |
| Subscription | Monthly | Your Cloud - Workspace Licensing |
| Subscription | Multi-year contract | Enterprise Custom |
| Freemium | Pay-as-you-go | 14-Day Trial |
Go-to-market motion3 records
Distribution channels3 records
Marketing channels5 records
ContraForce product offering
Product offeringCore offering
ContraForce builds an Agentic Security Delivery Platform that combines AI-driven Security Delivery Agents with a Gamebooks SOP enforcement engine to automate tier-1 and tier-2 security operations for MSSPs, MSPs, and enterprise security teams running Microsoft Sentinel and Defender XDR. The platform provides a multi-tenant control plane, federated access architecture with zero data custody, and automated MITRE ATT&CK mapping to enable sub-30-minute deployment and 60x faster incident response.
Product overview
ContraForce offers the Agentic Security Delivery Platform—a single unified platform for MSSPs, MSPs, and security operations teams. The core platform consists of Security Delivery Agents (autonomous AI that handles triage, investigation, evidence gathering, enrichment, documentation, and response execution) and Gamebooks (SOP enforcement engine that turns procedures into governed workflows with human-in-the-loop approval gates). The platform operates on top of Microsoft Sentinel and Defender XDR, with additional support for SentinelOne and CrowdStrike EDRs. Two deployment models are offered: ContraForce Cloud (ContraForce-hosted, pay-as-you-go investigations starting at $249/month) and Your Cloud (self-hosted in customer Azure subscription with flat per-workspace licensing). Both models include unlimited Security Delivery Agents, the Gamebook Engine, and core integrations.
Differentiator
Problem solved
Functional benefit
Quantifiable outcome
- 60x faster incident response (30-second vs 30-minute resolution)
- +6 more outcomes
Companies that use ContraForce
Customer profileNamed customers6 records
Segments4 records
Ideal customer profiles3 records
ContraForce technology and API
TechnologyAPI detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration12 records
AI capability5 records
Feature5 records
ContraForce partnerships and signals
Strategic signalPartnerships
Nine partnerships are on record, tiered core and supported.
- MicrosoftcoreCore technology partnership with Microsoft. ContraForce is a Microsoft ISV partner, MISA (Microsoft Intelligent Security Association) member, and Microsoft Pegasus Startup. Integrates natively with Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Entra ID via Graph Security API.
- Microsoft SentinelcoreNative integration with Microsoft Sentinel SIEM for real-time incident ingestion, correlation, and investigation across customer tenants.
- Microsoft Defender XDRcoreNative integration with Microsoft Defender XDR (Endpoint, Identity, Office 365, Cloud Apps) for incident response and automation.
- SentinelOnesupportedEDR integration supported alongside Microsoft Defender. SentinelOne customers can use ContraForce for security delivery without stack migration.
- CrowdStrikesupportedEDR integration supported alongside Microsoft Defender. CrowdStrike customers can use ContraForce for security delivery without forcing stack migration.
- ConnectWisesupportedTicketing integration with ConnectWise PSA for incident routing and service management workflow integration.
- AutotasksupportedTicketing integration with Autotask PSA for incident routing and PSA workflow integration.
- ServiceNowsupportedTicketing integration with ServiceNow for enterprise incident management and ITSM workflow integration.
- JirasupportedTicketing integration with Jira for issue tracking and project management workflow integration.
Scale indicators9 records
Recent moves6 records
Expansion highlights6 records
ContraForce competitors and assessment
Company assessmentDirect peers
- Torq: Torq is a security automation platform offering no-code workflows and AI agents for SOC teams, including autonomous hyperautomation. It directly competes with ContraForce in the multi-tenant MSSP delivery and AI-driven security operations category.
- Tines: Tines is a no-code automation platform widely adopted by MSSPs and security teams for incident triage, enrichment, and response workflows. It competes directly with ContraForce in the MSSP operations automation and SOAR-replacement category.
- Swimlane: Swimlane is a low-code security automation platform purpose-built for MSSPs with multi-tenant control plane and playbook automation. It is one of the closest direct competitors to ContraForce's MSSP-focused delivery platform.
- D3 Security: D3 Security provides smart SOAR with multi-tenant MSSP operations and automated incident response workflows. It competes with ContraForce in the MSSP security delivery and incident response automation category.
Emerging players
- Dropzone AI: Dropzone AI offers autonomous SOC analyst agents that perform alert triage and investigation. It is an emerging player in the AI-agent SOC automation space that overlaps with ContraForce's Security Delivery Agents.
- Radiant Security: Radiant Security provides an AI SOC analyst for autonomous alert triage and incident response. It is an emerging competitor in the AI-driven security operations delivery space that ContraForce targets.
- Intezer: Intezer provides autonomous SOC capabilities including alert triage and investigation powered by AI. It overlaps with ContraForce in autonomous security operations delivery for MSSPs and security teams.
Broad incumbents
- Microsoft Security Copilot: Microsoft Security Copilot is Microsoft's AI assistant for security analysts operating across Sentinel and Defender. It is explicitly positioned by ContraForce as a complementary (and potentially competing) platform within the same Microsoft ecosystem.
- Palo Alto Networks Cortex XSIAM: Cortex XSIAM is Palo Alto Networks' AI-driven SOC platform with autonomous SOC capabilities. ContraForce explicitly compares against XSIAM in its marketing, positioning its zero-data-custody model as a key differentiator.
Others
- ConnectWise: ConnectWise provides PSA/RMM platforms used by MSSPs and MSPs and is integrated with ContraForce. It is an ecosystem partner rather than a direct competitor, though it could expand into security operations delivery.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat5 records
Key risks6 records
Key highlights7 records
Customer concentration
ContraForce social profiles
Digital presenceContraForce compliance and trust
Trust signalCompliance3 records
ContraForce financial estimates
Financial estimateRevenue estimate
Valuation estimate
ContraForce leadership team
Management profileNumber of profiles
ContraForce funding detail
Funding detailFunding overview
Funding rounds2 records
Investors3 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
ContraForce M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about ContraForce
What does ContraForce do?
ContraForce builds an Agentic Security Delivery Platform that combines AI-driven Security Delivery Agents with a Gamebooks SOP enforcement engine to automate tier-1 and tier-2 security operations for MSSPs, MSPs, and enterprise security teams running Microsoft Sentinel and Defender XDR. The platform provides a multi-tenant control plane, federated access architecture with zero data custody, and automated MITRE ATT&CK mapping to enable sub-30-minute deployment and 60x faster incident response.
Is ContraForce a public or private company?
ContraForce is a private company. It is classified as venture growth investor backed and is currently operating.
When was ContraForce founded?
ContraForce was founded in 2021. It employs 11 to 50 people.
Where is ContraForce based?
ContraForce is headquartered in Mckinney, United States, in the North America region.
How does ContraForce make money?
Four revenue lines are on record. ContraForce Cloud - Platform Subscription is the primary driver. The others are pay-as-you-go Investigations, your Cloud - Workspace Licensing and enterprise Custom Pricing.
Who are ContraForce's main competitors?
Direct peers on record are Torq, Tines, Swimlane and D3 Security. Emerging players are Dropzone AI, Radiant Security and Intezer. Broad incumbents are Microsoft Security Copilot and Palo Alto Networks Cortex XSIAM. ConnectWise is listed as an others.
Does ContraForce have an API?
Yes. ContraForce offers REST and webhook APIs for integration and automation. The platform includes REST and webhook APIs on both deployment models (ContraForce Cloud and Your Cloud), enabling developers to build custom integrations and automate workflows. Available as part of the core platform with full audit trail and reporting capabilities. Developer documentation is at docs.contraforce.com.
What industry is ContraForce in?
ContraForce's product category is Security Operations / SOC Automation Software. Its primary akta.pro industry code is BPAEADAH, Endpoint Security Managed Services (EDR/XDR), with a secondary code of HDADAEAB, Extended Detection & Response (XDR). Its NAICS code is 513210 and its SIC code is 7372.