Ontinue | AI Transformation Index

Overview

Ontinue delivers Managed Extended Detection and Response (MXDR) services — outsourced 24/7 SOC operations combining AI-driven automation with human security analysts — to enterprise clients on a recurring fee-for-service basis, primarily built around the Microsoft Defender/Sentinel ecosystem.

Executive Summary

Ontinue is a cybersecurity MXDR provider that has moved quickly to embed agentic AI into its SOC operations — making it more operationally efficient — but this self-sufficiency substantially limits the unrealized AI opportunity that a PE sponsor could catalyze. The more pressing strategic question is durability: Ontinue's business model is structurally dependent on the Microsoft security ecosystem, and Microsoft is an increasingly direct competitor in the managed detection and response space, creating profit pool migration risk that AI acceleration will likely worsen rather than solve. The investment thesis hinges on whether Ontinue can build switching costs and proprietary threat intelligence deep enough to withstand platform-level competition, or whether the managed services wrapper around Microsoft security tools is a structurally compressing margin layer.

Durability Rationale

Ontinue's durability is structurally mixed: the underlying demand for enterprise cyber protection is persistent and growing, but Ontinue's specific intermediary position — sitting between Microsoft's native platform and the enterprise customer — is under increasing pressure from both directions. Microsoft has every incentive to capture the managed services margin itself, and AI-native tooling increasingly enables sophisticated enterprises to internalize what Ontinue provides. The trust and operational embedding that characterize the MXDR relationship provide real switching friction, but they do not constitute a pricing moat against the platform owner whose technology underpins the entire service. The absence of physical infrastructure or regulatory barriers means AI-native and platform-native competitors face a relatively low bar to replicate the delivery model.

Opportunity Rationale

The AI opportunity for Ontinue is real but substantially self-realized: the company has already deployed agentic AI to automate Tier 2 and Tier 3 investigations, achieving dramatic efficiency gains within its current operating period. This makes Ontinue a strong example of AI applicability in a cognitive-labor-intensive business, but it reduces the unrealized step-change that would make this a high-priority target for external AI catalysis — they are already doing it. The domain intelligence question is the most nuanced dimension: cybersecurity threat intelligence has genuine judgment-based depth, but Ontinue's Microsoft-platform specificity and reliance on shared threat feeds limits how much proprietary intelligence it has accumulated relative to the sector's largest players.

Key Risks