Percentage-based capability staging for security platforms that need to deploy new detection rules, modules, or policy changes to subsets of client environments before full rollout.
The Problem
Security platforms and MSSPs regularly ship new detection rules, threat intelligence integrations, and client-facing modules. Pushing these changes to all client environments simultaneously is how one bad rule causes false-positive storms across an entire tenant base.
There is no native mechanism in most SOAR or MDR platforms to stage a new capability at 20% of clients, monitor for noise, then expand. Teams either ship to everyone and hope, or hold releases entirely. Both outcomes are operational failures.
The Solution
A flag-based rollout manager that treats each security capability as a configurable object: enabled state, rollout percentage, and target environment scope stored separately. Access is calculated at runtime, not hardcoded. A client simulator validates access decisions before any rule goes live.
Key Features:
- Per-flag toggle with independent enabled/disabled state per capability
- Rollout percentage slider controlling what share of client environments receive access
- Client simulator that accepts a user ID or tenant identifier and returns an access decision in real time
- Local persistence so flag configurations survive panel reloads without a backend dependency
- Reset to defaults for rapid rollback when a detection rule causes noise
Use Cases
SOC-as-a-Service MSSPs: Stage a new threat detection module at 10% of client tenants during validation, expand to 50% after a clean week, then push to 100% on confirmed stability. Rollback is one toggle.
Mid-Market MDR Platforms: Ship updated phishing detection logic to a canary cohort before the full customer base. Client simulator confirms which tenant IDs fall inside the rollout boundary before deployment.
GRC Compliance Platforms: Gate new compliance control modules (HIPAA, ISO 27001 clause additions) behind rollout flags so clients can be onboarded incrementally without breaking existing audit evidence flows.
Impact
- Eliminates full-blast rule deployments that cause false-positive spikes across all tenants
- Enables per-client capability staging without custom per-environment configuration files
- Reduces rollback time from a code deployment to a single toggle state change
- Gives operations teams control over release cadence without engineering involvement
Built by Kunsh Tanwar | ETXcyberops | [email protected]
