Guest blog courtesy of LimaCharlie.The LimaCharlie SecOps Cloud Platform (SCP) is a new way for MSSPs to meet their infrastructure needs.
Because our approach to security infrastructure is so different from everything else on the market, we’re often approached by service providers wanting to know more—and somewhat uncertain about how to begin. This piece is a very brief introduction to the SCP and, more importantly, a playbook to help MSSPs start getting value out of the platform immediately.
Introducing the SCP: A public cloud platform for cybersecurity
The SCP is a public cloud-like platform for cybersecurity service providers. The fundamental premise behind the SCP is to take the public cloud provider model that has worked so well in the world of IT DevOps (think AWS, GCP, Azure, etc.) and apply it to cybersecurity.
It’s a tried-and-true approach in the world of IT, but new in cybersecurity. The SCP is different from other cybersecurity platforms in a number of important ways—and those differences translate into significant benefits for service providers:
- On-demand delivery. Everything in the SCP is available on demand. Nothing is obligatory. Teams adopt only what they need, when they need it. No need to purchase tooling and infrastructure that won’t ever be used.
- Pay-per-use pricing. Teams pay for what they use, and nothing more. There are no mandatory long-term contracts; no monthly minimums. Pricing is transparent and predictable. Teams can scale usage up or down as needed without worrying about cost overruns or termination fees.
- Built for service providers. The SCP is designed with the needs of service providers in mind. All tools are offered API-first. Multi-tenancy is the default, and security controls and settings are managed using infrastructure as code (IaC). For MSSPs, that means no more black-box tools that can’t be customized. No need to manually configure dozens of client organizations individually. Just robust security infrastructure built for modern SecOps at scale.
- Full control of telemetry data. The SCP gives teams the ability to collect telemetry data from any source; enrich, prune, and transform that data in-flight; and then route it to any destination. The SCP also provides one year of free storage for all ingested telemetry data, helping users meet compliance and retention needs.
- A unified platform. All SCP modules are built from the ground up for integration. The platform has a single interface and a common data format. There are no integration headaches, because unlike the so-called “all-in-one” tools sold by other vendors, the SecOps Cloud Platform is a genuine platform—not a hodgepodge of acquired point products bundled together under a web portal.
- Easy integration with other solutions. The SCP doesn’t try to be “the only tool you’ll ever need.” We recognize that modern SecOps is far too complex for that. To return to the IT public cloud comparison, AWS doesn’t mandate (or expect) that teams will use their solutions exclusively. The SCP is similarly unopinionated: It allows security practitioners to integrate any third-party solution with—and through—the platform.
- Bi-directional communication with third-party tools. Ease of integration also means ease of management and response. Teams can use the SCP to ingest security telemetry from, say, O365, and then use the SCP’s automation engine to take response actions via O365.
Stepwise adoption, not rip and replace
As you may have noticed, the SCP’s public cloud-like delivery and pricing model also contains a significant implication for adoption:
There’s absolutely no need to go “all in” on the SCP at once—or jettison other solutions overnight.
Because the SCP is on-demand, pay-as-you-go, and easy to integrate with other tools, it’s possible to begin experimenting with the platform gradually, bringing new capabilities online as your team is ready, without disrupting your existing stack.
In fact, this is what we recommend to most new users: a thoughtful program of stepwise adoption rather than a massive rip-and-replace operation.
In fact, there are plenty of great ways to get started with the SCP, all equally valid. In what follows, we’ll share some common adoption steps that have worked well for service providers in the past.
The first group comprises “first steps” that help new users realize value quickly—sometimes in a matter of days. The second group encompasses more ambitious projects with the SCP that, nevertheless, can often be implemented within a single quarter.
Where to start with the SCP: The first 30 days
Save money on SIEM costs: The SCP lets teams
build powerful observability pipelines, similar to a solution like Cribl, but as part of the basic functionality of the platform rather than as a complex point product.
The SCP lets teams bring in telemetry data from any source; transform, anonymize, and enrich it in-flight; and output it to any destination. This lets teams send
only necessary data to the SIEM, routing the rest to a low-cost data lake. Lower-priority telemetry data can also be retained in the SCP cloud, using the platform’s one year of free storage to cover data retention needs at no additional cost beyond that of ingestion. By using the SCP’s native observability and data routing capabilities, many teams can achieve significant reductions in SIEM spending almost immediately.
Close coverage gaps: The SCP can often help MSSPs close coverage gaps in their current stack. To offer just one example, teams that rely on telemetry from free editions of Microsoft Defender in a client’s environment often experience significant lags between a security event and the corresponding Microsoft Defender alert coming into the SOC. These lags can range from a few minutes to multiple
hours—creating a serious obstacle to rapid threat detection and effective response. However, by using the
SCP’s Endpoint Protection extension, teams can now get these Microsoft Defender alerts in real time and take automated response actions immediately.
Offer better SLAs with sleeper deployments: The SCP’s usage-based billing option lets MSSPs pre-deploy endpoint detection and response (EDR) agents across client organizations for just pennies per month. SCP agents wait on client endpoints in “sleeper mode,” essentially doing nothing more than maintaining a connection to the LimaCharlie cloud. If an incident occurs, these sleeper agents can be activated immediately, giving responders access to the SCP’s powerful EDR capabilities in a matter of minutes. Our users have found that
SCP sleeper deployments allow them to offer highly competitive service-level agreements (SLAs) to their customers—with some of them offering SLAs of just 20 minutes.
Next steps: 60- to 90-day projects
Replace one-off tools: The SecOps Cloud Platform offers numerous cybersecurity capabilities and an ecosystem of 100+ integrations and extensions. MSSPs can reduce tool sprawl by identifying one-off solutions in their current stack and replacing them with SCP equivalents—achieving comparable or superior performance while reducing the team’s overall infrastructure management burden.
Identify a solution in your stack that only sees limited use—ideally one with a license that’s about to expire, or that your team sees as a necessary evil. Then, work with our engineers to find a suitable SCP alternative, test, and deploy. Rinse and repeat for other solutions in the stack as needed.
Eliminate manual workflows: The SCP can significantly increase operational efficiency by helping teams eliminate manual workflows. In 2025, no one wants to be stuck doing “click-ops” with their security tools. The SCP was built by security engineers, for security engineers, on the assumption that today’s MSSP teams have both the skills and the desire to implement truly modern SecOps workflows.
The SCP’s extensive automation capabilities let teams automate basic response actions so they can spend more time on higher-value work. The platform’s multi-tenant architecture allows service providers to manage multiple organizations more easily, and onboard new clients faster than ever before. IaC controls also facilitate scalable SecOps, because essential settings and rulesets are stored in a limited number of configuration files, enabling teams to make changes across multiple client organizations far more easily—sometimes by updating a single master config file and pushing out the changes to everyone with a click.
Replace portions of your current SIEM functionality: SIEMs are a major expense for most security teams. Our upcoming advanced Search functionality will bring the core capabilities of a modern SIEM to the SecOps Cloud Platform for the first time. SCP Search gives security analysts, detection engineers, and incident responders a powerful, intuitive way to query and contextualize vast amounts of telemetry data—often at a fraction of the cost of their existing SIEM solution. By shifting some SIEM workloads to transparently priced, cost-effective SCP Search equivalents, MSSPs can reduce infrastructure spending without sacrificing security outcomes. SCP Search is ideal for real-time investigations, tuning and testing detection rules, performing data-intensive searches more cost effectively, and more.
How to start now
There are few limits to what an innovative MSSP can achieve with the LimaCharlie SecOps Cloud Platform. To learn how the SCP can help your organization save money, modernize operations, and compete more effectively,
book a demo today.
