Littlefish Group has partnered with ContraForce to integrate AI-based tools into its managed security operations, a move designed to accelerate incident response while keeping human analysts in control of every decision. The deal reflects growing pressure on managed security providers to process higher alert volumes as attackers adopt the same AI technology to increase the speed and scale of their activity.
The partnership centres on Littlefish's Managed Security Operations Centre (SOC), where ContraForce's software will handle early-stage triage, context gathering and incident classification. The system is built to cut the time needed to identify potential risks, while final decisions remain with cyber analysts. Incidents that previously took hours to assess could be reviewed in seconds or minutes, the companies said.
Sean Tickle, Head of Cyber Security at Littlefish Group, said the model is about enhancement rather than replacement. "AI is changing the cyber security landscape on both sides of the equation. Organisations are exploring how it can help them move faster and deliver more value, while attackers are using the same technology to become more sophisticated and harder to detect," he said. "We believe the answer isn't to replace people with AI. The real power comes from combining intelligent AI context and workflows with human expertise."
How the technology fits into existing operations
ContraForce's platform acts as a delivery layer above Littlefish's Microsoft-based security systems. The software takes incidents through stages including triage, investigation, response, tuning, ticketing and customer reporting, based on procedures set by the provider. Governance, control and accountability remain with experienced security staff throughout the process.
The arrangement allows analysts to focus on judgement, response actions and broader risk reduction rather than sorting through alert queues. For security operations teams managing multiple clients, this shift matters: each additional client brings its own environment, alert volume and expectations, and response standards must hold across all of them.
Scaling security operations without losing control
Stan Golubchik, Founder and Chief Executive Officer at ContraForce, described the challenge of running a SOC at scale. "Every client a provider adds brings its own environment, its own alert volume and its own expectations, and the standard has to hold across all of them," he said. "This partnership lets Littlefish's SOC put intelligent AI agents alongside analysts rather than in place of them, cutting the time it takes to separate real threats from noise and act on them."
Littlefish supports more than 1 million users globally across public and private sector organisations. The Nottingham-based group provides cyber security, managed services, cloud, data and business technology consulting to customers in the UK, Ireland and other markets. The ContraForce agreement reflects a broader push to help clients adopt new technologies while managing operational and security risks.
Broader trend toward analyst-led automation
The partnership follows a wider shift in cyber security toward combining automated analysis with human review, particularly in managed SOCs that must handle high alert volumes across diverse customer environments. Providers face pressure to maintain response standards without adding headcount for every new client. The approach Littlefish and ContraForce are taking places AI for Cybersecurity Analysts in a supporting role, surfacing information faster so staff can spend more time on resilience and risk reduction.
For managed security providers, the strategy increasingly depends on demonstrating that AI can improve incident handling speed without reducing control over sensitive systems and data. In Littlefish's model, analysts remain at the centre of every decision. The software handles the information-gathering work; people make the calls.
Why this matters for operations teams
For operations professionals, this partnership signals a practical model for integrating AI into high-stakes workflows without surrendering human oversight. The core logic - use machines to accelerate data processing and triage, keep people in charge of judgement and accountability - applies well beyond security operations. Teams managing infrastructure, service delivery or incident response can take a similar approach: identify the repetitive, high-volume analysis tasks that slow down decision-making, and apply automation there while preserving human control over actions that carry risk. The goal is faster coverage, not fewer people.
Your membership also unlocks:
