Flare sees rapid MSSP uptake of external threat intel

Flare reports a 114% year-on-year increase in adoption among managed security service providers (MSSPs), as more providers embed external threat intelligence into day-to-day service delivery.

Flare attributes the rise to demand for broader visibility into external threats without increasing analyst workload. It also points to a shift in procurement, with MSSPs aiming to cut operational overhead by consolidating multiple intelligence tools into a single platform.

External threat intelligence is now a core input for many security services, particularly as customers ask for faster insight and clearer outcomes across diverse IT environments. MSSPs often need coverage beyond a client's own networks, including sources such as the dark web, cybercrime forums, messaging platforms, and open sources.

Flare positions its product as a way to integrate these sources into monitoring and investigative work. According to the company, MSSPs use the platform for ongoing monitoring, investigations, and customer-facing security outcomes.

"Our growth with MSSPs reflects how deeply threat intelligence is being integrated into security services today," said Andrew Bartlam, VP, Global Channels and EMEA Sales at Flare. "We're seeing service providers use Flare as part of how they deliver ongoing monitoring, investigations, and customer-facing security outcomes, and that role is driving continued adoption."

Tooling shifts

The reported growth comes amid broader changes in how managed providers operationalise threat intelligence. Many MSSPs have historically relied on traditional threat intelligence platforms, which can require significant tuning and integration to translate raw intelligence into customer-ready services.

Operational scale remains a central challenge. MSSPs must repeat workflows across many customer environments and often face licensing constraints and the cost of adding staff for triage and analysis. As a result, buying decisions tend to favour products that fit existing service delivery processes and commercial models.

Flare says MSSPs are moving away from platforms that are difficult to operationalise at scale and are prioritising options that align with how they package and monetise services. The shift reflects a focus on repeatable delivery rather than one-off analysis.

Consolidation is another driver. Security teams and service providers have accumulated numerous tools for monitoring external sources and managing intelligence feeds. That fragmentation can slow investigations and customer reporting, and it can complicate efforts to standardise services across different customer tiers.

Service models

Flare says it offers flexible models for different types of security service engagements, including fully managed services as well as project-based and consulting work. It also highlights support for services-led organisations that conduct penetration testing, red teaming, and other time-bound engagements.

The approach reflects the commercial variety across the MSSP market. Many providers combine recurring monitoring contracts with fixed-scope projects, incident support, and advisory work. Tools that span these lines of business can reduce internal friction and make it easier to standardise training and playbooks.

Flare also cites demand for broad external visibility without increasing analyst workload. In managed services, additional human effort affects margins and can limit how many customers each analyst can support. Tools that reduce manual collection and triage can therefore influence service pricing and staffing models.

Flare says its platform provides a single environment for external threat data across customer deployments, with visibility across the dark web, cybercrime forums, messaging platforms, and open sources. It adds that the breadth can reduce the need to stitch together multiple tools.

Partner focus

MSSPs sit alongside other channel partners in Flare's partner ecosystem, which also includes distributors, value-added resellers, consulting firms, and global systems integrators.

Flare plans to meet MSSPs at the Right of Boom 2026 event in Las Vegas to discuss intelligence-led security services and how service-delivery models are evolving.