Fully managed SOAR for MSPs

What it is

Traditional SOAR is priced and sized for large enterprises, and standing one up runs to months of integration work. Lono is the other bet. It is fully managed: Lono does all the development work, the integrations, the automations, the runbooks, and operates the platform as an ongoing service for a flat monthly rate. An MSP gets a working SOAR without hiring anyone or waiting a quarter for onboarding.

That pricing only works because of how streamlined the platform is. Thirty years of working security data went into the design, so the hard parts arrive already built: ingestion for whatever a client runs, enrichment for every indicator, case management made for cyber and fraud investigations, and a runbook library keyed to MITRE ATT&CK, one per technique and sub-technique. An analyst opens a case and the runbook is already on it: the investigation questions, the containment steps and the escalation path for that exact technique.

The consultancy site carries it: six services, real booking availability, lead capture with nurture email, and the GEO markup that gets the site cited by AI assistants.

Under the hood

• Fully managed, not self-serve: Lono takes on the developer role, building and running every integration and automation, for a flat monthly rate. Traditional SOAR contracts start near what this costs per year, and that is before the integration project.
• Streamlined by design: 30 years of working security data went into the platform's shape. That is what makes a flat rate possible: the pieces arrive pre-built instead of being assembled per customer.
• Ingestion from whatever the client runs: any event source, pushed or polled. XDR is the most common, but the same pipeline takes IAM and identity providers, email security, PII and data-protection tools, vulnerability scanners, cloud and network logs, and existing helpdesk tickets. Nothing gets ripped out and replaced, and if a client has no XDR, Lono provides one.
• Enrichment on every indicator: geolocation, ASN and BGP ranking, passive DNS, URLhaus, ThreatFox and Tor exit checks, written onto the case as structured data. Traditionally a separate line item.
• Runbooks, not blank pages: 656 playbooks, one per MITRE ATT&CK technique and sub-technique, across 203 techniques, each with monitoring guidance, key IOCs, investigation questions, containment steps, Level 1 and Level 2 procedures and escalation reasoning.
• Case management for investigations: cases, alerts, IOCs, timeline, attack graph, tasks and evidence in one system, with report templates for the write-up.
• Automation that reports its own failures: remediation, cleanup and an internal failure-report workflow, so a broken automation says so instead of going quiet.
• Live in two weeks, against the six months a conventional integration asks for.

How it got built

The runbook library came first. Security teams do not need another dashboard, they need the steps, so a set of technique cards was built out, one per MITRE ATT&CK entry including sub-techniques, and a generator compiled them into runbooks with real procedure: what to look at, how to contain it, when to escalate. 656 of them, every one written out. Then the plumbing: orchestration workflows for ingestion, enrichment and remediation, an enrichment layer with a dozen analyzers behind it, and case management to hold the investigation. The assembly is the product, and that is what makes the business model work. Because the platform is streamlined and the pieces are pre-built, Lono can do the development work for the customer and still run the whole thing on a flat monthly rate, live in two weeks instead of six months.

Stack