ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24×7 managed detection and response across endpoint, network, cloud, identity, and log sources
Eyes-on-glass SOC and continuous threat hunting
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Get ultimate assurance that your environment is free from threat actors
Quickly recover from cyber attacks and breaches
24×7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Cloud-based SIEM platform providing visibility across all your data sources
Manage your external footprint, publicly available data, and Dark Web leaks
AI triage, investigation and response on the tools you already run
Fully featured distrubuted NDR for on-premises and public cloud environments
Deploy honeypots and honeytokens and stay ahead of threat actors
Every alert investigated, with a verdict and the evidence behind it
Integrated endpoint agent providing deep visibility, response and forensics
Log management and threat detection across any of your log sources
A SecOps platform purpose-built for industrial and OT environments
ThreatDefence puts security and compliance at the heart of our service, keeping your data protected at all times.
See how we keep your data secure.
Guides, case studies, and advisories in one place
Read what our customers say about us
Solution briefs and datasheets
Technical support and knowledge base
What to check in your Microsoft 365 tenant
Remote code execution flaws that need patching now
Essential Eight monitoring, reporting, and evidence for ongoing compliance
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to Incident Response and Digital Forensics
Read how cyber range helps to train cyber defenders
How AI agents investigate alerts and run security operations
How AI SOC platforms work, from integrations to autonomy
Free ebook: a practical guide to adopting an AI SOC platform
How brand impersonation works and how to detect and stop it
How lookalike domain attacks work and how to take them down
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Where SOAR playbooks fit, where AI agents take over, and how the two work together.
AI SOC hyperautomation transforms cybersecurity ops by autonomously detecting, analyzing, and remediating threats.
Honored to Support the Launch of the University of Technology Sydney Cybersecurity Precinct!
ThreatDefence Cyber had the privilege of meeting with Honeywell Dubai’s Digital City leadership to explore synergies in OT/SCADA and…
Read More
Equinox to support companies with ready to use, end-to-end SecOps infrastructure, including a full stack platform able to capture and…
ThreatDefence had an amazing time at AISA CyberCon 2024, connecting with industry leaders and advancing cyber security conversations.
Run an agentic SOC under your own brand. AI agents investigate alerts across your clients, while your analysts stay in control of decisions and response.
Every new client adds work to your SOC. Keeping investigations thorough and response fast becomes harder as analysts stretch across more environments, putting service quality and margins under pressure.
Analysts spend their shifts checking routine activity and gathering context, leaving less time and energy for complex threats.
Constant noise divides attention. Important signals can sit unnoticed in the queue, giving attackers more time to act.
Following an attack across accounts, endpoints, and applications takes time. Backlogs grow while clients wait for answers and action.
Different tools, critical systems, and response procedures make consistent delivery harder. Analysts must apply the right context and rules to every case.
Deliver security operations from onboarding to client reporting on one multi-tenant platform. Connect the tools your clients already use, automate investigations, and coordinate response under your brand as your service grows.
Create isolated client tenants using reusable configurations. Set procedures, escalation paths, and permissions, then manage investigations across your client base from one queue.
Collect alerts and telemetry through APIs, syslog, webhooks, or agents. Give investigations access to evidence across each client’s environment, with no need to replace existing tools.
Agents investigate incoming alerts using each client’s context and policies. Supported benign findings close automatically where authorized; suspicious or uncertain cases reach analysts with evidence and recommended actions.
Your analysts, ThreatDefence’s SOC, and client teams collaborate on shared cases. Evidence, timelines, decisions, and approvals stay together, with updates synchronized to ITSM tools.
Coordinate containment across connected tools, from revoking sessions to isolating endpoints. Each client’s permissions, approval requirements, and execution limits govern the response, with outcomes recorded in the case.
Run reusable hunts within one tenant or across authorized clients. Investigate matches, identify data gaps, and turn validated findings into cases, proposed detections, and branded reports.
Connect analysts’ AI agents through the platform’s MCP server. Explore data, run skills, and prepare reports using plain language, with role-based access, tenant boundaries, and logged tool calls.
Generate branded service reports, incident summaries, and executive briefings from client records. Show what was investigated, how threats were handled, and which risks still need attention.
Explore the ThreatDefence AI SOC platform →
Handle more client work with automated investigations, coordinated response, and clear service reporting.
Investigate high-volume alerts across clients, including lower-severity signals that can be overlooked. Resolve supported benign activity under client policies and bring analysts the cases that need attention.
Connect suspicious sign-ins, token misuse, mailbox changes, and application access to uncover account compromise. Prepare containment or act within each client’s approved limits.
Take complex cases from initial findings through containment, forensic investigation, and remediation. Keep evidence and decisions together as work moves between analysts, specialists, and client teams.
Give clients a branded portal to follow cases, response progress, and outstanding actions. Turn service records into reports that explain threats handled, performance trends, and priorities for improvement.
Explore the partner workspace, your branded client portal, and customer reporting in a live demo.
Make the platform your own with white-label options for the client portal, reports, and notifications. Use your logo, colors, and domain to give clients a consistent experience under your brand, while keeping the relationship with your team.
Apply your logo and colors, and use a custom domain for a familiar client experience.
Turn service activity into clear reports covering threats handled, response performance, and recommended next steps.
Select the modules, dashboards, and case views available to each client based on their service.
Manage a growing client base from one partner workspace. Shared workflows keep delivery consistent, while each tenant retains its own service settings and security boundaries.
Work one queue of AI-investigated alerts, ranked by risk and SLA. See urgent cases, pending approvals, and approaching deadlines across every client.
Set procedures, escalation contacts, SLAs, modules, and autonomy per client. Apply the right response rules to every case without managing separate deployments.
Tenant boundaries protect data, credentials, agent memory, and case records. Analysts access assigned clients, and investigations stay within the relevant tenant’s permissions.
Apply shared detection content and investigation skills across tenants, with tuning for each environment. Hunt across authorized clients to check whether a threat affects others.
Configure escalation paths, approval requirements, and response procedures for each client. These settings guide agents and analysts throughout the case, so the service reflects each client’s priorities and agreements.
Set autonomy per workflow and action type. One client can allow automatic containment while another requires approval for the same action.
Agents investigate, assess the evidence, and recommend next steps. Analysts decide whether to close, escalate, or respond.
Agents prepare case closures or response actions with supporting evidence. An authorized analyst reviews and approves before execution.
Agents carry out specifically authorized actions when the client’s conditions are met. Scope limits and recovery procedures govern execution, with outcomes recorded and exceptions escalated.
When a new threat emerges, find out which clients may be affected. Cross-tenant hunting lets analysts search current and historical data across authorized environments, using a question, indicator, or reusable hunting skill.
/td hunt m365-signin-forensics --days 30
Scanned 30 days of sign-ins for acme-corpglobex-corpinitech. Three findings, every query is attached to the hunt record.
Want me to open a case for the first finding and draft a detection for token replay followed by rule creation?
/td hunt endpoint-persistence --days 30
Checked scheduled tasks, services and run keys on 214 endpoints in acme-corpglobex-corpinitech. Three findings.
Want me to open a case for FS-02 and pull the full process tree for the scheduled task?
/td hunt data-exfiltration --days 14
Compared outbound volumes in acme-corpglobex-corpinitech against each host’s 90-day baseline. Three findings.
Want me to open a case for the engineering workstation and list the files that were archived?
/td hunt ndr-network-anomalies --days 7
Analyzed 7 days of flows and DNS for acme-corpglobex-corpinitech. Three findings.
Want me to open a case for the beaconing host and check which process owns the connection?
/td hunt leaked-credentials --days 90
Matched breach and infostealer data against accounts in acme-corpglobex-corpinitech. Three findings.
Want me to open a case for the finance user and prepare a password reset and session revocation for approval?
/td hunt full-hunt-sweep --days 30
Ran 14 hunting skills across acme-corpglobex-corpinitech. Three findings need attention.
Want me to open cases for the first two findings and attach the queries from this sweep?
AI agents investigate matches and gather context, helping analysts distinguish expected activity from threats that need action. Confirmed findings become cases within the affected client’s tenant, keeping evidence, ownership, and response separate.
Turn validated attack patterns into proposed detections for testing and approval. Apply them across relevant client environments, with local tuning where needed, so one hunt can improve protection across your service.
Explore AI threat hunting →
Show each client what your SOC delivers: investigation coverage, faster response, and analyst time saved. Live dashboards and monthly reports track performance and AI verdict quality, with supporting case records behind the figures. Review results per client or across your service to identify where improvement is needed.
Add capabilities as each client’s needs grow, offering them individually or bundling them into your service packages. Everything runs through the same tenant and portal, giving clients broader protection and AI agents more context for investigation and response.
AI triage, investigation, response, threat hunting, detection engineering, case management, and reporting across your connected tools.
Detect lookalike domains, cloned websites, and impersonating profiles.
Identify exposed credentials and references to your organization in underground sources.
Discover internet-facing assets, exposed services, and security weaknesses.
Investigate Microsoft 365 identity threats, risky applications, and account activity.
Monitor internal and outbound network activity for suspicious behavior.
Track security posture, control gaps, risk ownership, and remediation priorities.
Understand which AI tools are in use and what data is being shared with them.
Collect and retain security telemetry, with detections maintained by ThreatDefence engineers.
Faster investigations. Clear evidence. Coordinated response.
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
Δ
An AI SOC for MSSPs uses AI agents to investigate alerts across client environments, with analysts directing investigations and response. ThreatDefence provides the multi-tenant platform to manage that work, including cases, automation, and client reporting.
Yes. MSPs can build a security offering, while MSSPs can expand existing SOC operations. Both use one partner workspace with separate client tenants, configurable procedures, and optional support from ThreatDefence’s SOC.
No. Connect their existing tools through APIs, syslog, webhooks, or agents. The platform uses these connections to gather evidence across the environment and, where supported, execute approved response actions.
Monitoring can begin once the initial integrations, access permissions, and service procedures are configured. Reusable tenant configurations simplify setup, and additional sources can be connected as onboarding progresses.
Tenant boundaries separate client data, credentials, agent memory, and case records. Analysts access only assigned environments, and permissions are enforced when agents query tools or analysts search across tenants.
Agents assess the evidence against each client’s context and closure policies. Automatic closure is limited to authorized conditions, with the supporting assessment recorded. Suspicious activity, uncertainty, or missing evidence triggers analyst review.
Yes, within the permissions you configure for each client and action type. Actions can be recommended, held for approval, or executed autonomously within defined limits. The platform records outcomes and provides controls to suspend workflows.
Yes. Authorized analysts can search across client environments using a question, indicator, or reusable hunting skill. Agents investigate matches, and confirmed findings become cases within the affected client’s tenant.
Yes. Connect compatible AI agents through the ThreatDefence SOC MCP server to query data, run skills, and prepare reports. Access follows the analyst’s role and assigned tenants, with every tool call logged.
Yes. White-label options let you use your logo, colors, and custom domain, with branded reports and notifications. You can also control which modules and views each client can access.
Provide branded service reports, incident summaries, and executive briefings. Dashboards show investigation coverage, response times, AI verdict quality, and estimated analyst time saved, with supporting investigation records available for review.
Yes. ThreatDefence’s 24x7 SOC can work alongside your analysts on the same cases. Monitoring, investigation, response responsibilities, and escalation procedures are agreed to match the support your team needs.
Yes. Add capabilities such as brand protection, dark web monitoring, attack surface management, ITDR, NDR, and managed SIEM per client. Offer them individually or within service packages, using the same tenant and portal.
Skills and detection content your team develops remain your intellectual property. Authorized users can also export client data and investigation records through the platform’s API.
AI SOC Platform Guide: your path to AI-enabled security operations
The ThreatDefence AI SOC platform: triage, investigation, and response
What is an agentic SOC? How AI-driven security operations work