LightEDR for MSSPs: multi-tenant detection and response at scale
How LightEDR's single control plane and transparent £5/agent/month pricing makes deploying EDR across multiple clients practical for MSSPs.
Running EDR for multiple clients is a different problem than running it for one organisation. You need isolation between tenants, consistent tooling across environments, and pricing that scales without killing your margins. Most enterprise EDR platforms were designed for internal security teams - multi-tenant support was bolted on later, and it shows.
This post covers how LightEDR is structured for MSSP use: how tenant isolation works, what the control plane looks like from the analyst desk, and how the pricing model fits partner economics.
Why multi-tenancy is harder than it looks
The obvious part of multi-tenancy is data isolation - Client A’s telemetry shouldn’t be visible to Client B’s portal. Most EDR vendors get this right at the storage layer. What they get wrong is the operational layer.
A typical enterprise EDR console is designed for a single organisation with a single alert queue, a single set of detection rules, and a single team working through them. When MSSPs adapt these tools, they end up with:
- Separate login credentials for each client tenant
- No way to triage across clients in a single view
- Detection rules that must be configured independently per tenant
- Billing that is often negotiated per-client rather than per-agent
The workarounds - shared admin accounts, external scripts to aggregate alerts, spreadsheets to track per-client status - add operational overhead that eats into your margins.
How LightEDR handles MSSP operations
LightEDR’s control plane is built around tenants from the start. When you log in as an MSSP partner, you see all your managed clients in a single dashboard. You can drill into a specific client’s alert queue, or work across the aggregate view - your choice.
Each client environment is fully isolated at the data layer. Their agents, their telemetry, their trust assessments, their alert history - none of it bleeds across tenant boundaries. The isolation is structural, not a policy toggle.
A few specifics that matter for MSSP workflows:
Single console, multiple clients. One login, one interface. Switch between client environments without logging out and back in. The alert queue shows which client each alert belongs to; you can filter by client, severity, or MITRE ATT&CK technique across the whole portfolio.
Per-client detection tuning. Detection rules can be configured globally (applying to all tenants) or per-client (overriding for a specific environment). A client running unusual but legitimate tooling that generates noise elsewhere? Tune it for them without touching anyone else’s configuration.
One-click containment, scoped to client. When you isolate an endpoint, it is contained within that client’s environment. The contained endpoint cannot reach other hosts on the client’s network, but the containment action only affects that client. The 90-day telemetry retention window stays available for post-incident review, per client.
AI triage at scale. LightEDR’s LLM-assisted triage integrates with five providers - Anthropic, OpenAI, Azure OpenAI, Gemini, and Ollama (the last one useful for air-gapped client environments). For MSSPs handling high alert volumes across multiple clients, the AI explanation and triage suggestion cuts time-per-alert significantly. You configure the provider once at the MSSP level; it applies across all client tenants without blocking alert ingestion.
What the economics look like
Standard enterprise EDR pricing is usually per-seat, negotiated annually, with minimum commitments that make it hard to bring on small clients or trial accounts. The minimum buy-in on CrowdStrike or SentinelOne effectively excludes any client below around 200 endpoints.
LightEDR is priced at £5 per agent per month, with a free tier up to 5 agents. For MSSPs, this means:
| Client size | Monthly cost | Annualised |
|---|---|---|
| 10 agents | £50 | £600 |
| 50 agents | £250 | £3,000 |
| 200 agents | £1,000 | £12,000 |
| 500 agents | £2,500 | £30,000 |
No minimum commitment, no per-client negotiation, no sales call required to get a quote. You onboard a client, enrol their agents, and they appear in your console. Billing is aggregated across your account.
This matters operationally as much as financially. When EDR costs are predictable and linear, you can offer it as a standard service line rather than a negotiated add-on. Every client above the free tier threshold pays the same rate; you are not managing different price structures across your portfolio.
For smaller clients - a 20-person professional services firm, a GP surgery, a law firm - the economics work in a way they simply do not with legacy vendors. That opens up a market segment that is currently underserved on endpoint security.
Getting started
If you are evaluating LightEDR as an MSSP platform, the practical next step is to set up a partner account and enrol a handful of test agents across two or three simulated client tenants. The multi-tenant isolation and cross-client console behaviour are the things worth seeing directly rather than reading about.
To discuss partner pricing or a technical walkthrough, get in touch.