{"id":24278,"date":"2026-11-11T09:43:16","date_gmt":"2026-11-11T09:43:16","guid":{"rendered":"https:\/\/any.run\/cybersecurity-blog\/?p=24278"},"modified":"2026-11-11T09:52:42","modified_gmt":"2026-11-11T09:52:42","slug":"us-mssp-success-story","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/us-mssp-success-story\/","title":{"rendered":"American MSSP Company on Integrating Threat Intelligence to Scale Without Sacrificing Quality"},"content":{"rendered":"\n

After months of using ANY.RUN Interactive Sandbox<\/a>, a US-based MSSP expanded its security stack with ANY.RUN Threat Intelligence.<\/a> By bringing known malicious indicators directly into its SIEM, the team could reduce manual checks and focus deeper investigations on threats that required behavioral analysis. This helped the growing MSSP<\/a> increase operational capacity without compromising service quality. <\/p>\n\n\n\n

We talked to the MSSPs\u2019 Head of SOC about how they achieved more connected security workflows, reduced manual checks, and brought threat context into their existing stack by expanding the use of ANY.RUN<\/a> solutions. <\/p>\n\n\n\n

The Starting Point: A Growing MSSP <\/h2>\n\n\n\n

Before expanding its use of ANY.RUN, the organization (which preferred to remain anonymous \u2013 Ed.) was looking for a way to scale without sacrificing investigation quality. The MSSP company was expanding its customer base, maintaining strong service quality, and taking on larger clients, including enterprises with thousands of endpoints to protect. <\/p>\n\n\n\n

Behind these results was a close-knit SOC team of one manager and five analysts. They had established effective investigation processes, relying on SIEM enrichment and open-source IOC checks. But taking on more customers<\/a> also meant more alerts to investigate, more SLA commitments to meet, and growing pressure on staffing costs: <\/p>\n\n\n\n

\n

We were getting more customers and more alerts to deal with. Hiring more analysts was one option, but we also wanted to improve the way we worked.<\/p>\n<\/blockquote>\n\n\n\n

As they started to scale their services, operational improvements became necessary. The number of customers and alerts increased, and the team needed to handle a larger workload without compromising investigation quality or putting additional pressure on analysts. The goal was to find a better balance between quality and speed.<\/strong> <\/p>\n\n\n\n

Integrating Sandbox into SOC Workflows <\/h2>\n\n\n\n

The US-based MSSP<\/a> was already using ANY.RUN Interactive Sandbox<\/a> on an individual basis, but its role in the company’s SOC operations was limited. With more alerts to process, the team decided to integrate Sandbox into its existing security workflows by moving to the Enterprise Suite plan. <\/p>\n\n\n\n

They integrated<\/a> Sandbox with its existing SIEM using ANY.RUN’s API. This allowed analysts to incorporate sandbox analysis into their established investigation process rather than working with it as a separate tool. <\/p>\n\n\n\n

\n

The team already knew Sandbox was useful because we’d been using it for a while. The next step was making it part of how the whole company worked.<\/p>\n<\/blockquote>\n\n\n\n

Operational Improvements <\/h3>\n\n\n\n

The integration of ANY.RUN Sandbox allowed the team to build on its existing success<\/a> by achieving: <\/p>\n\n\n\n