MDR Provider Launches an Identity Monitoring Tier and Cuts Analyst Triage Time by 47%
Executive Summary
A managed detection and response provider serving mid-market and enterprise clients wanted to launch an identity monitoring tier. Its clients were asking whether the service covered exposed credentials and infostealer-sourced compromise, and competitors were beginning to win deals on the strength of identity features the provider did not have. Building a breach-data collection program in-house would have taken quarters and an ongoing maintenance burden the provider did not want to own. By licensing Constella’s verified signals through one API, the provider launched the tier in weeks, cut analyst triage time per exposure event by 47%, and turned an identity gap into a new recurring revenue line.
The Challenge: An Identity Gap in the Service Catalog
The provider had strong endpoint and network detection but no identity monitoring tier. Two pressures converged. Clients were asking specifically about exposed credentials and infostealer infections, and the provider was returning honest but commercially damaging non-answers. At the same time, the sales team was losing competitive deals to providers that had bolted an identity feature onto their service.
The obvious response, building a breach and infostealer collection capability in-house, was a poor fit. It would require continuous discovery of ephemeral and adversarial sources, verification, and normalization, plus permanent maintenance, all far outside the provider’s core competency. The provider also worried that a raw feed would flood analysts with unverified alerts, adding triage load rather than client value.
The Solution: Verified Signals Through One API, Not a Data Program
The provider integrated Constella’s Intelligence API as the data layer behind a new identity monitoring tier. Coverage is built by continuously hunting breaches across the surface, deep, and dark web, including the infostealer ecosystem, so the provider got the breadth of breaches hunted without building the collection program. Because the signals are verified and normalized rather than raw, they arrived with provenance and confidence already established.
- Constella’s breach and infostealer signals were mapped to client identities, email address(es), and domains, and surfaced inside the provider’s existing analyst console and client reporting, with multi-tenant separation.
- Curate at the source. Verified, normalized signals meant analysts no longer had to validate raw exposure data by hand. Each exposure event arrived ready to action, cutting the manual validation step that had been the bulk of triage time.
- Differentiate. Infostealer-sourced compromise was added as a signal category that the competing identity features did not offer, giving sales a concrete differentiator.
The Result: 47% Faster Triage and a New Recurring Tier
- Analyst triage time per exposure event fell by 47%, because verified signals removed the manual validation step that had dominated the workflow.
- The identity monitoring tier launched in weeks rather than the quarters a build would have required, and became a new recurring revenue line.
- Competitive win rate improved on deals where identity features had previously been a gap, with infostealer coverage as a named differentiator.
- Client-reported satisfaction with exposure alerting rose, attributed to fewer false positives reaching the client and faster analyst response.
An MDR can add an identity monitoring tier by integrating a verified breach and infostealer data source through an API, mapping exposure events to client identities and domains, and surfacing them in the existing analyst console and client reporting. The data layer is the hard part, so most providers license verified signals rather than build a breach-collection program from scratch.
Raw or unverified breach feeds generate noise that analysts must validate by hand, which consumes triage time. Verified and normalized signals arrive with provenance and confidence already established, so analysts can act on them directly. Fewer items need manual validation, and triage time per exposure event falls.
Building a breach and infostealer collection program requires continuous source discovery, verification, and normalization across ephemeral and adversarial sources, plus ongoing maintenance. For most MSSPs the total cost of ownership of buying verified data through an API is lower than building and maintaining that pipeline, and the time to launch a new tier is far shorter.
Conclusion
For a managed detection and response provider, an identity monitoring tier is a service problem, not a data-collection project. The provider closed the identity gap in its catalog by licensing verified signals rather than building a pipeline, which let it launch in weeks, keep analysts focused on real exposure instead of validation, and win deals it had been losing. The data depth came from Constella; the service and the client relationship stayed with the provider.