Skip to main content
Delivered through managed security partners

Run ShadowMap as your own managed service.

Plenty of organisations that need continuous exposure monitoring would rather buy it from the firm already running their security programme. NTT, Tata Communications and Noventiq take ShadowMap to their own clients today, embedded in a managed portfolio in some cases and co-sold into enterprise accounts in others. Your practice, your client relationship, our platform and intelligence operations underneath it.

Talk to us about partnering How the platform works

What you operate

The platform under your delivery

A partner gets the same collection, the same correlated exposure model and the same takedown operations a direct customer gets. What partner delivery adds is separation: a tenant per client, roles scoped to the book an analyst is assigned, and an audit trail that lets you show one client their data was never reachable from another's console.

Your side

What the partner brings

The client relationship
You hold the account, the contract and the commercial conversation. We are not introduced to your client as a second vendor unless you want us in the room.
The delivery practice
Analysts on a rota, a triage discipline and a reporting rhythm that already exist. ShadowMap slots into them, so your clients do not have to learn a second operating model.
Judgement about the client
Which findings matter for this client, what their regulator asks of them, and what their board will actually read. That context sits with you.
Our side

What ShadowMap brings

Collection and correlation
Every capability runs continuously against each client estate: Attack Surface, Brand Protection, Data Exposure, Dark Web, Threat Intelligence, Threat Feeds, CART, Vendor Risk Management, Unified Console. All of it resolves into one correlated exposure model per client. The same set a direct customer buys.
Tenancy and access control
Each client is a separate tenant under your organisation. Roles decide what a person can reach: administrator, analyst, SOC user, and a scoped vendor seat for third parties you invite in. An analyst assigned to three accounts sees three accounts. SSO via SAML or OIDC against your identity provider, and an audit log recording actor, source address, target and timestamp per tenant.
The operations you would otherwise staff
Takedown filing and follow-through against impersonating domains, pages and profiles: unlimited, subject to fair use. Fair use means notices filed for the marks and estate under monitoring, not a filing channel opened for third parties. Where managed service is part of the engagement, that extends to direct escalation into the Security Brigade red team for incidents.

Delivery models

Who runs the console is the decision

Every model carries the same platform, the same tenant separation and the same evidence trail. What changes is where the analyst hours sit and whose name is on the delivery. Partners move between them as their bench grows, and they can differ client by client inside one agreement.

ShadowMap partner delivery models
ModelWho runs the consoleWho the client deals withWhere it fits
Partner-operated Your analysts You, end to end A managed practice with a staffed bench
The Platform + Support SKU, taken across a client book instead of a single estate. Your team triages, assigns and reports; we stay behind you for escalation, product support and the onboarding programme your delivery team runs through first.
Partner-fronted, ShadowMap-managed ShadowMap analysts, behind your practice You (our analysts work to your cadence) Opening a segment before the bench is hired
The Platform + Support + Managed Service SKU. The operating model is chosen per engagement: dedicated remote, dedicated on-site, or a shared analyst for SME-sized clients. It is the same set of models a direct customer picks from on the pricing page.
Co-delivered Split by agreement, per client Both names, in the open Integrator and telco engagements into enterprise accounts
A co-branded delivery where the client wants both parties visible. Tata Communications works this way into enterprise accounts in India and Tier 1 global accounts; the split of scoping, operations and reporting is set in the engagement, not by a standard template.

ShadowMap partner delivery models

Partner-operated

Who runs the console
Your analysts
Who the client deals with
You, end to end
Where it fits
A managed practice with a staffed bench

The Platform + Support SKU, taken across a client book instead of a single estate. Your team triages, assigns and reports; we stay behind you for escalation, product support and the onboarding programme your delivery team runs through first.

Partner-fronted, ShadowMap-managed

Who runs the console
ShadowMap analysts, behind your practice
Who the client deals with
You (our analysts work to your cadence)
Where it fits
Opening a segment before the bench is hired

The Platform + Support + Managed Service SKU. The operating model is chosen per engagement: dedicated remote, dedicated on-site, or a shared analyst for SME-sized clients. It is the same set of models a direct customer picks from on the pricing page.

Co-delivered

Who runs the console
Split by agreement, per client
Who the client deals with
Both names, in the open
Where it fits
Integrator and telco engagements into enterprise accounts

A co-branded delivery where the client wants both parties visible. Tata Communications works this way into enterprise accounts in India and Tier 1 global accounts; the split of scoping, operations and reporting is set in the engagement, not by a standard template.

The two SKUs and the three managed-service operating models named above are the same ones a direct customer chooses from. See pricing for what each one includes.

Who this suits

Firms that already deliver security

This works for a firm with a managed security practice already in place: analysts on a rota, a triage discipline, clients who expect a report on a cadence. ShadowMap gives that practice a continuous external-exposure capability without building the collection infrastructure behind it, and the client sees your service, not a second console with someone else's logo on it.

It suits an assessment practice for a different reason. Penetration testing, red team and audit engagements surface external exposure every time, and that picture is stale the week the report ships. Monitoring turns a point-in-time engagement into a line item that runs between them, and gives your consultants a reason to be in front of the client in the eleven months they otherwise are not.

What the partner programme covers
  • MSSPs and MDR providers adding a continuous external-exposure line to a managed portfolio.
  • Consultancies with an assessment, red-team or audit practice that want something to sell between engagements instead of a report that goes stale the week it ships.
  • System integrators and telcos embedding ShadowMap inside a larger security portfolio for enterprise accounts.
  • Regional partners in markets where a local contracting entity, local delivery or local data residency is a condition of the sale.

Deliberately excluded

  • Referral-only arrangements. This programme is built around partners who deliver. An introduction with no delivery attached is a better fit for the Security Brigade partner programme, which runs a referral route of its own. Say so at the first conversation and it goes there instead.
  • Resale with no delivery capability behind it. A licence handed to a client who then has nobody to operate it renews badly for both of us.
  • A rate card on this page. Terms are set per partner in the agreement: the delivery model, the territory and the client profile all move them, so what is published here is the variables, not the numbers.

How to start

How onboarding works

Each step decides the shape of the next, so terms come after the delivery model, not before it. Nothing here needs a signed agreement to begin.

  1. Step one

    A scoping conversation

    What your practice delivers today, which clients you would put on it first, and whether your analysts or ours run the console. That answer picks the delivery model, and the delivery model is what everything commercial is then written against.

  2. Step two

    Terms, set per partner

    Partner pricing works off the same variables as direct pricing: asset surface, brands and vendor portfolio under monitoring, capability footprint, and whether managed service is included. Terms are agreed once for your book instead of renegotiated client by client, and they account for the delivery you are taking on. We publish a direct-price floor, not a partner rate card, because the delivery split moves it.

  3. Step three

    Your tenancy, your roles, your clients

    You get your own organisation with a client tenant underneath it for each account, roles scoped so an analyst reaches only the book they are assigned, and SSO against your identity provider. Enablement runs with a ShadowMap engineer: the same onboarding a direct customer gets, aimed at your delivery team instead of an end client.

  4. Step four

    One client end to end, then the book

    One apex domain in, attributed inventory out, and the first findings triaged jointly so your analysts see how the evidence is assembled before they own the queue. Run one client through the full cycle before the rest of the book follows: discovery, triage, a takedown, a client-facing report.

Partnership conversations start at contact. Tell us what your practice delivers today and which clients you would put on it first. It reaches our team, not a marketing list, and a person replies within one business day. If what you are bringing is an introduction and not a delivery practice, the Security Brigade partner programme runs a referral tier and is the better door.

Bring us the practice. We'll bring the platform.

One conversation covers what you deliver today, which delivery model fits, and what the terms look like for your book. Terms are agreed with you, not published, because they are written against the delivery you are taking on.

Start a partner conversation See what is priced