Why alert triage is the constraint, not headcount
The unit economics of a security practice are set by how many client servers one analyst can watch without missing things. Add clients and you add alerts linearly, so a practice that triages by hand hits a ceiling and then hires, which is the point where margin stops improving with scale.
The lever is not more people, it is fewer alerts that need a person. Automatic blocking of attacking addresses removes the highest-volume category before anyone reads it. AI audits turn a server into a prioritised, scored report rather than a log to interpret. What reaches your team should be the set that genuinely needs judgement.
What you can actually brand
- Brand name, logo and primary colour applied to the client-facing dashboard.
- Your own custom domain, provisioned through Cloudflare for SaaS, so clients reach the platform at your hostname rather than ours.
- Alert emails sent under your brand name in the sender display name.
Managing clients
Client organisations are created from your dashboard: you provide the organisation name and the owner email, the account is created with a temporary password, and the owner receives a branded invitation. Each client is a separate organisation, so their servers, incidents and data are isolated from every other client.
You assign the plan tier for each client, which sets their entitlements and limits. Your own reseller entitlement caps what you can assign, so the tiers available to you match what you are entitled to resell.
When you need to work inside a client account, you can open a scoped, time-limited session into their dashboard from your own. That access is recorded, which matters when a client asks who did what.
One view across the portfolio
The fleet view lists every server across every client organisation with its agent health, latest risk score and open incident counts, so you can look at the whole portfolio without switching between accounts.
From there you can trigger an AI security audit on a client server, and bulk-resolve incidents on a server once you have dealt with them. Audits run against the client organisation’s own plan limits rather than yours.
What SecAI does and what stays yours
SecAI provides the detection, the automatic response, the audits and the reporting. It does not provide the client relationship, and it does not want to: you own the account, the pricing you charge, the SLA you offer and the decision about what to escalate.
Concretely: SecAI blocks attacking addresses, monitors files, processes, packages and websites, scores risk and produces evidence. You decide the remediation policy per client, whether a given server runs in Awaiting Approval or Automatic mode, what your response times are, and what a client sees.
Honest limits worth knowing before you commit
The reseller fleet view currently shows agent health, risk scores and incident counts per server. Website monitor health and per-server vulnerability counts are visible inside each client organisation rather than aggregated into the cross-client fleet table, so checking those means opening the client account.
Compliance PDFs are generated within a client organisation rather than batch-produced across the portfolio from the reseller view.
Billing is between you and SecAI: assigning a plan to a client sets their entitlements, it does not create a billing relationship between SecAI and your client. You bill them.