How AI Could Reset the Economics of Managed Security Services

Twenty-four-hour security operations create an unavoidable economic problem. Threat actors do not observe business hours. An organization requiring continuous monitoring must therefore fund security operations across nights, weekends, holidays and multiple shifts.

Historically, IT teams could address this requirement by maintaining multiple shifts within one country. But operating an entire 24x7 security organization using a single domestic labor market is expensive. Under a follow-the-sun operating model, responsibility moves between teams located in different geographic regions as their respective business days begin and end.

The follow-the-sun operating model did not create one universal percentage price drop, but the historical evidence suggests it reset managed services economics by roughly 20–40%, with deeper labor-cost reductions possible in heavily offshore models.

The model offered several economic advantages:

• Reduced dependence on overnight and weekend staffing within one geography
• Access to broader labor markets
• Lower blended labor costs
• Continuous coverage without increasing domestic headcount
• Greater scalability as customer volume increased

Over time, global delivery became common enough that the economics of the market began reflecting it. Providers could still differentiate around U.S.-based analysts or domestic-only delivery. Certain government, regulated, defense and highly sensitive organizations might even require it.

But for much of the commercial market, the pricing benchmark increasingly assumed some level of global delivery. The critical lesson is not that customers stopped preferring U.S.-based resources. Many did not. Instead, preference proved different from a willingness to pay.

When two providers could offer comparable 24x7 outcomes and one operated from a structurally lower-cost global delivery model, domestic-only delivery increasingly required either a price premium or reduced provider margins.

Eventually, global delivery became less of a differentiator and more of an embedded assumption within market pricing.

That history matters because AI appears positioned to create the same effect.

The follow-the-sun transition changed where security labor was performed. AI changes how much security labor must be performed by humans at all.

That is potentially far more disruptive. Consider the traditional economics behind a service provider.

Regardless of whether a customer is ultimately charged per endpoint, user, firewall, GB of SIEM ingestion, incident or fixed monthly subscription, a significant portion of the provider’s cost structure can usually be traced back to the line of effort to support the environment.

Automation has been reducing portions of that workload for years, but AI has the potential to accelerate the process dramatically.

Instead of merely helping an analyst perform an investigation, an AI system may perform much of the investigation itself. The economic implication is significant.

A service provider historically needing 100 units of analyst capacity to support a particular customer population may eventually require 70, then 50, then perhaps 30 units of equivalent human capacity as automation improves.

The precise number is less important than the direction. The question becomes less about where to locate the next analyst and more about whether an analyst performs this investigation at all.

AI adoption is unlikely to eliminate large portions of analyst labor immediately. The transition will likely occur in stages.

Stage One: Analyst Augmentation

Initially, AI acts as a productivity tool. Analysts use it for:

• Investigation summaries
• Natural-language queries
• Threat-intelligence research
• Evidence correlation
• Case documentation
• Recommended next actions
• Report preparation

Customers may see little difference in the service, and the service provider retains approximately the same staffing model but receives incremental productivity improvements.

The provider captures much of the economic benefit through higher operating efficiency.

Stage 2: Workflow Optimization

As confidence improves, management begins examining how many analyst interactions remain necessary.

If an AI investigation consistently reaches the same conclusion as an analyst, requiring the analyst to manually repeat the investigation becomes difficult to justify economically.

Human review begins moving toward cases involving:

• Low-confidence findings
• Material incidents
• Privileged identities
• Business-critical systems
• Potential lateral movement
• Destructive actions
• Unusual attacker behavior
• High-impact response decisions

AI agents operate on the front line while ambiguous or consequential investigations escalate to expert humans.

Stage Three: Operating Model Redesign

At this point, the security operations center (SOC) itself is redesigned around AI.

The traditional staffing pyramid evolves:

The number of human analysts required may decline, while the remaining human role becomes increasingly concentrated around exceptions, consequential decisions and specialized expertise. Whether providers reinvest the resulting capacity into higher-value human services is an economic choice, not a technological inevitability.

Stage Four: Investment Maximization – The Tipping Point

This stage may prove most consequential. Managed security service providers (MSSPs) are investing heavily in agentic AI.

Once a services partner has made a substantial investment in AI infrastructure, automation, models, integrations, governance and security-specific training, there is a financial incentive to maximize utilization of that investment.

If AI allows one analyst to oversee three times the previous workload, the provider has several possible ways to monetize the improvement of productivity:

• Increase margins
• Reduce prices
• Increase the number of customers supported per analyst
• Reallocate analysts into higher-value services
• Combine all four

What is economically unlikely over the long term is for the service provider to permanently retain the same analyst-to-customer ratio while AI performs most of the operational workload. This creates what might be called the AI efficiency paradox.

Initially, AI efficiency benefits a services partner.

Suppose two hypothetical providers deliver similar security outcomes but operate with very different delivery models. A traditional, labor-intensive SOC might incur approximately $600,000 in annual service delivery costs to support a $1 million customer engagement. A provider that has redesigned its service around autonomous investigation, automation and exception-based human intervention might eventually deliver an equivalent outcome for $350,000.

Initially, there is little incentive for the more efficient provider to reduce its price. It could continue charging approximately $1 million and capture substantially higher margins. Competitive markets, however, rarely allow that advantage to remain entirely with the provider.

Competitors begin offering equivalent services for $900,000, then $800,000 or less. Procurement organizations collect benchmarks, customers gain greater visibility into what comparable security outcomes should cost and renewal negotiations begin reflecting the new delivery economics.

Eventually, the economic benefits of automation move beyond improved provider margins and begin translating into lower market prices for managed security services.

AI Productivity Becomes AI Price Compression

The provider’s innovation becomes the customer’s expectation. This has happened repeatedly in technology services. Automation that once differentiated a provider eventually became expected.

This market reset creates a significant challenge for MSSPs that prefer highly human-centric co-managed delivery. Imagine two competing offers.

Provider A: Human-Centric MSSP

• Human review of most investigations
• Lower analyst-to-customer ratios
• Named security personnel
• Extensive customer interaction
• Traditional Tier 1/Tier 2 investigation model

Annual price: $1.2 million

Provider B: AI-First MSSP

• AI investigates most alerts
• Humans review ambiguous and consequential events
• Higher analyst-to-customer ratios
• Automated investigation reporting
• Comparable contractual response outcomes

Annual price: $850,000

The customer may strongly prefer Provider A’s service philosophy. But a 30% annual difference forces a customer to quantify the value of that preference. Security leadership then faces the same question buyers encountered with domestic-versus-global delivery: How much more are we willing to pay for human participation?

Once enough customers accept Provider B’s model, $850,000 begins influencing what procurement believes the service should cost. Provider A now has three choices:

• Match the market price and accept lower margins
• Maintain its operating model and justify a premium
• Redesign its delivery model

Over time, the third becomes increasingly likely. This leads to a critical economic principle. Not every MSSP will become fully autonomous. But every MSSP may eventually have to price as though routine security operations are autonomous.

With long-term pricing pressure this will lead to consolidation in the industry with human-led MSSPs becoming acquisition targets for AI-led MSSPs, resulting in fewer options for clients.

Human expertise is unlikely to disappear from security operations. It may instead become more valuable and more expensive.

Customers will continue to need experienced professionals for:

• Complex investigations
• High-impact incidents
• Threat hunting
• Detection engineering
• Business-context interpretation
• Incident command
• Executive communications
• Regulatory decisions
• Risk acceptance
• Response authorization
• Legal and HR coordination

The question is whether humans must perform routine operational activity simply because humans historically performed it. In an AI-first environment, the answer will increasingly be no.

This creates several possible service tiers.

However, unlike core organizations that have preserved the availability of U.S.-based models, including state, local and federal government organizations and those with strict compliance requirements, no such mandates exist for human-led MSSP models, putting more pressure on the business model to survive over the long term.

Consider three models. All three approaches may appropriately exist. The problem arises when customers cannot determine which one they are buying.

Human-in-the-Loop

AI performs the investigation, but certain decisions cannot occur without explicit human approval. High repetitious review work for the analyst adds little value to the process once initial model training is matured.

Human-on-the-Loop

AI performs investigations and actions independently within predefined authority. Humans supervise overall performance and intervene when thresholds, anomalies or exceptions arise.

Human-out-of-the-Loop

AI investigates, determines disposition, closes cases and potentially performs response actions without routine human participation.

An MSSP could legitimately state that “SOC analysts oversee every customer environment” even if those analysts directly review only a small percentage of investigations. Likewise, a provider could advertise “24x7 human-backed MDR” without defining whether human involvement occurs in 5%, 25% or 100% of investigations.

As AI adoption increases, these distinctions become economically material.

In this scenario, MSSP customers should treat human involvement as a measurable service characteristic.

A useful starting concept is a human engagement ratio (HER): The percentage of security investigations in which a qualified human analyst performs substantive investigation, validation or decision-making before final disposition.

The metric should not become another easily manipulated SLA. A 15-second review of an AI-generated recommendation should not necessarily count as meaningful human investigation. Customers should assess several dimensions.

Human Investigation Rate

What percentage of security investigations receive substantive human analysis?

Ask separately for:

• Overall investigations
• High severity
• Medium severity
• Low severity

Autonomous Closure Rate

What percentage of security events can be closed as benign without human validation? This may become one of the most revealing questions in an AI-era MDR evaluation.

Human Decision Rate

For incidents ultimately classified as malicious or requiring customer notification, what percentage receive human validation?

Automated Response Authority

What actions will AI execute without human authorization?

Examples include:

• Endpoint isolation
• Account disabling
• IP/domain blocking
• Firewall modification
• Email quarantine
• Credential revocation

Analyst Qualification

When human involvement occurs, what level of expertise is involved? There is an important difference between “human involved” and an experienced security investigator.

Buyers should understand whether escalations are assigned to:

• Tier 1 analyst
• Tier 2 investigator
• Tier 3 analyst
• Threat hunter
• Detection engineer
• Incident responder

Escalation Criteria

What explicitly causes an AI-managed investigation to escalate to a human? Providers should be able to describe confidence thresholds and conditions that trigger human intervention.

Named Resource Access

Does the customer have access to:

• Named security advisors?
• Named SOC leadership?
• Threat hunters?
• Detection engineers?
• Service delivery managers?
• Incident commanders?

Or is human interaction exclusively queue-based?

Human Time Allocation

MSSP customers may eventually ask providers to disclose the approximate human service capacity allocated to their environment. This does not necessarily mean purchasing hours. It means understanding whether a $500,000 service includes meaningful ongoing human expertise or primarily access to an AI platform with occasional escalation.

The emergence of AI does not eliminate the co-managed security model. It changes its definition.

Historically, co-management largely addressed the division of operational work: Which monitoring, investigation, response and escalation activities are performed by the service provider, and which remains the responsibility of customer personnel?

In an AI-first operating model, the more consequential questions become: Which decisions can AI make autonomously? Which conditions require service-provider human judgment? Which actions require customer authorization?

That is a fundamentally different model of co-management.

The boundary between a MSSP and customer moves away from simply allocating investigative workload and toward defining decision rights, escalation conditions and levels of permitted autonomy.

Under this structure, humans may remain critical without remaining the primary production mechanism. But the reduction of routine analyst workload does not guarantee that providers will reinvest the resulting capacity in more experienced analysts, deeper expertise or greater customer engagement.

AI creates two fundamentally different economic opportunities.

A provider can reinvest productivity gain, using available human capacity to increase access to higher-value capabilities such as detection engineering, threat hunting, incident leadership, security architecture, business-risk interpretation, governance and advisory services.

Or it can harvest the productivity gain by increasing customers supported by each analyst, reducing staffing requirements, expanding margins, lowering prices or some combination of those outcomes.

The technical ability to move human expertise toward higher-value work does not mean customers will automatically receive more of it. As AI-driven efficiencies become embedded in competitive pricing, maintaining additional human capacity may become increasingly difficult unless customers recognize its value and are willing to pay for it.

This creates two very different versions of the future co-managed service.

In one model, AI removes repetitive investigation work, and the provider reinvests some of that capacity into:

• Detection engineering
• Threat hunting
• Security architecture and platform engineering
• Incident leadership
• Exposure management
• Security governance
• Business-risk interpretation
• Executive advisory
• Technology lifecycle management

In the other model, AI removes the same repetitive work primarily so that fewer people can support more customers.

Both MSSPs may legitimately describe their services as AI-enabled, co-managed security. Both may achieve strong operational metrics. Yet the amount of human expertise, customer intimacy and advisory value included in the service could be materially different.

That creates an important issue for buyers. AI efficiency should not be confused with reinvestment in expertise. An MSSP may have deep technology partnerships, engineering capabilities, threat hunters, incident responders and advisory resources somewhere within the organization without those capabilities being meaningfully included in the managed service being purchased.

Co-managed customers will therefore need to understand not only what AI is authorized to do, but also what happens to the human capacity AI replaces. Does the provider reinvest some of that efficiency into higher-value expertise and customer engagement or does the efficiency primarily support higher customer-to-analyst ratios and lower delivery costs?

The strategic objective should not be to resist AI. AI should remove repetitive, low-value human effort wherever it can do so safely and effectively. The more difficult question is what happens to the economic value created afterward.

AI creates the opportunity to move human expertise upward. It does not create an obligation for providers to do so and that distinction may become one of the most important differences between co-managed security providers in an AI-first market.

There is one final risk service providers should consider. An AI-first SOC may objectively become better while customers subjectively believe the service has deteriorated.

Operational metrics may demonstrate:

• Faster investigation
• Lower response times
• Greater consistency
• Higher automation
• Fewer false positives
• More incidents processed
• Lower operating cost

Meanwhile, the customer may observe:

• Fewer conversations with analysts
• Less familiarity with its environment
• More automated case summaries
• More portal-based interactions
• Fewer named resources
• Less perceived partnership

Both perspectives can simultaneously be true. That distinction is important because managed security is not purely a technology purchase.

Customers are also purchasing judgment, accountability, confidence, access and trust. The service partners that succeed may therefore not be those that use the most AI. They may be those that best determine where humans create enough customer and security value to justify their cost.

The service provider industry has experienced this type of economic reset before. Customers once preferred domestic security operations personnel, but competitive economics pushed much of the market toward global follow-the-sun delivery. The preference did not disappear. It became something customers had to deliberately choose and pay more to receive.

AI may repeat that process at a deeper level. Productivity will create margin. Competition will convert some of that margin into lower prices. Those lower prices will become procurement benchmarks. Eventually, AI efficiency may become embedded in the market-clearing price for managed security.

Human expertise is unlikely to disappear. But extensive human participation may evolve from an assumed feature of managed security into a premium service characteristic that customers must deliberately select, measure and purchase.

For service providers, the challenge is to capture AI economics without commoditizing the trusted human relationships that differentiate managed services. For organizations seeking managed security services, the challenge is to determine where human judgment is guaranteed, who provides it, how often it occurs and which decisions AI is permitted to make without it.

The future of managed security will not be defined by human versus AI. It will be defined by the economics of deciding where human judgment is valuable enough to remain.

AI can accelerate investigations, reduce operational costs and improve efficiency, but security is ultimately about decisions, accountability and trust. As managed security models evolve, organizations should understand where human expertise is embedded within their provider’s service. Learn how CDW delivers managed security services designed to combine the speed of automation with the insight of experienced security professionals.