Operate threat intelligence across clients without losing context.

Serving twenty clients should not cost twenty times as much

That is the whole economic question of a managed CTI service, and it is decided by how scoping works. If relevance is established per client automatically, adding a client adds configuration. If analysts sort a merged queue by hand and remember who each finding belongs to, adding a client adds an analyst — and the service stops being profitable somewhere around the point it starts being interesting.

So the multiplier is not a feature detail. It determines whether the practice scales, and it is set by whether client context is structural or a matter of discipline.

The same signal has different answers for different clients

One leaked document naming a shared supplier is urgent for one client, already known to a second, and irrelevant to a third. If triage state is a property of the finding rather than of the client-finding pair, those three answers collide: whoever reviews it first decides for everyone.

Keeping the decision per client is what lets a provider run one collection pipeline and still give each organisation an honest, independent answer — including the case where the same underlying item is confirmed for one and dismissed for another.

Isolation is a commercial requirement

Clients of a service provider are frequently competitors, sometimes in a regulated relationship, and always entitled to assume their exposure is not visible to the provider's other customers. A tenancy model that leaks one client's assets, findings, or alert history into another client's view is not a bug to be fixed later; it is the kind of failure that ends the contract.

That is why scoping runs through assets, findings, triage state, delivery channels, and access roles rather than being applied at the presentation layer. Filtering a shared view is a display decision; scoping the data is a boundary.

Reporting is the deliverable

In an in-house team, the work is the product. In a service, the evidence of the work is the product — the client is buying an assurance and reads a report. A month in which nothing was found still has to be demonstrable, and the difference between "nothing happened" and "nobody looked" has to be visible in the record.

That requires the operational history to be durable: what was collected, what was reviewed, what was decided, by whom, and when. Reporting then draws on the record rather than being reconstructed at the end of the month from memory and screenshots.

Onboarding cost sets the floor

The practical limit on how small a client can be is how long it takes to onboard one. If a new organisation needs a week of tuning before its queue is trustworthy, small clients are unservable and the practice is pushed upmarket whether or not that was the plan.

The lever is the asset inventory: domains, brands, product names, supplier names, and terms tied to specific people. It is a short exercise when it is the explicit starting point, and an endless one when relevance is instead tuned by adjusting filters against a queue that is already too noisy.