I work with an organization that focuses on money management. So we usually deploy for organizations such as banks, pension providers, and major IT firms that are interested in this. I've even deployed for micro-finance banks.
People use it to analyze security event information from their servers. It could be from an IaaS server address. They get logs we didn't know how to interpret and it helps them to prioritize. When a device connects, after the analyzation it prompts the administrator depending on the server data entered into it.