ContraForce
Agentic Security Delivery Platform for MSPs and MSSPs running Microsoft Sentinel and Defender XDR, with Security Delivery Agents that autonomously triage, investigate, and respond across unlimited customer tenants.
ContraForce is a McKinney, Texas security company (founded 2021 by Stan Golubchik and Ricky Melendez, backed by Y Combinator, GALLOS, and DataTribe with a 3.25 million dollar seed round) that builds an Agentic Security Delivery Platform for MSPs, MSSPs, and security teams operating in the Microsoft security ecosystem. Its Security Delivery Agents, powered by Azure AI Foundry and Microsoft agent frameworks, autonomously handle incident triage, investigation, evidence collection, response, and documentation across multi-tenant Microsoft Sentinel and Defender XDR environments, with supervised or autonomous execution modes. Gamebooks enforce SOP-driven playbook execution across tenants, and the platform captures remediation snapshots to standardize response. Federated least-privilege access keeps security data inside each customer tenant with zero data custody. The company reports 60x faster investigations and 93 percent lower cost per incident, was named Security Orchestration Solution of the Year in the 2025 CyberSecurity Breakthrough Awards, and launched its Security Delivery Platform with Microsoft in November 2025.
Vendor details
Canonical URL
https://www.contraforce.com
Category
Security / SOC agent
Funding status
Private, seed stage. Founded 2021 in McKinney, Texas by Stan Golubchik and Ricky Melendez; raised a 3.25 million dollar seed round co-led by GALLOS Ventures and DataTribe, with Y Combinator participation.
Company status
independent
Use cases & customers
Primary use cases
Target customers
Deployment options
Integrations
Deep native integrations with Microsoft Sentinel, Defender XDR, Defender for Endpoint, and Entra ID, built on Azure and Azure AI Foundry, plus multi-tenant data connectors and ticketing tool integrations through API connections.
Sources & related URLs
Related / legacy domains
Capability coverage
9.0 / 14 capabilities · 64%
| Integrations & Tool CallingNative integrations with Microsoft Sentinel, Defender XDR, and Entra ID plus ticketing tool connectors via API connections (contraforce.com). | Full |
|---|---|
| Workflow OrchestrationSecurity Delivery Agents run full triage, investigation, and response workflows with Gamebooks enforcing SOP-driven playbooks across tenants (contraforce.com). | Full |
| Knowledge Grounding & RAGA context engine improves over time and remediation snapshots feed future incidents; no general RAG documented (contraforce.com). | Partial |
| Human Oversight & GuardrailsSupervised or autonomous execution modes with analysts able to review, approve, or modify agent actions in real time (contraforce.com/for-providers). | Full |
| Security, Identity & GovernanceSOC 2 Type II audited with federated least-privilege access and data kept in the customer tenant with zero data custody (contraforce.com). | Full |
| Observability & AuditabilityFull audit logging of Security Delivery Agent actions with a unified command view across tenants (contraforce.com). | Full |
| Memory & State PersistenceRemediation snapshots are captured and linked to future incidents and a context engine improves over time; no first-class agent memory documented (contraforce.com, cbinsights.com). | Partial |
| Deployment & Data ResidencyCloud SaaS on Azure with security data staying inside each customer tenant; no self-host of the platform documented (contraforce.com). | Partial |
| Prebuilt Agents / Templates / PacksPrebuilt Security Delivery Agents, a Gamebooks playbook library, and detection content continuously deployed across tenants (contraforce.com). | Full |
| Triggers & Channel CoverageIncident-driven agent activation with continuous monitoring across all customer tenants (contraforce.com). | Full |
| Model Flexibility & RoutingAgents are powered by Azure AI Foundry; no user-facing model choice documented (contraforce.com). | Unable to verify |
| APIs / SDKs / MCP ExtensibilityIntegration connectors exist but no public developer API, SDK, or MCP is documented (contraforce.com). | Unable to verify |
| Testing, Debugging & OptimizationDetection rules are generated, tuned, and validated continuously across tenants (cbinsights.com award coverage). | Partial |
| Browser / Computer-useNo browser or computer use is documented (contraforce.com). | Unable to verify |
Pricing
From two hundred forty nine dollars per month plus pay as you go investigations; a free getting started option is offered.
Monthly platform subscription plus pay as you go investigations.
Cost watchouts
Investigation volume is billed pay as you go on top of the platform subscription, so incident-heavy months raise cost; multi-tenant scale pricing is not published.
Variable cost rationale
A base subscription anchors cost but pay as you go investigation charges scale with incident volume across tenants.
Overage / add-ons
Investigations are billed pay as you go beyond the base subscription.
Sales call required
Mixed (some tiers require a call)
Free / trial
A get started for free option is offered on the site.
Lowest paid plan
Two hundred forty nine dollars per month starting price with pay as you go investigations.
Key ambiguities
The two hundred forty nine dollar starting price appears in comparison copy; full tier structure and per-investigation rates are not published.
Related vendors
- 7AI — Swarming agentic SOC from the Cybereason founders: sixty plus domain…
- Airrived — Agentic OS that unifies SOC, GRC, IAM, vulnerability management, IT,…
- Assail — Autonomous red teaming platform (Ares) whose AI agents discover,…
- Astelia — AI native exposure management platform from Israeli National Red…
- Capsule Security — Runtime security layer for AI agents that detects and blocks unsafe…
- Clutch Security — Universal non human identity security platform that discovers,…