AI agents investigate every alert, add context, and prepare cases for response, on a full-stack SecOps platform that captures and correlates all your security data.
Cloud-based SIEM platform providing visibility across all your data sources
Every alert investigated, with a verdict and the evidence behind it
Manage your external footprint, publicly available data, and Dark Web leaks
Log management and threat detection across any of your log sources
Get ultimate assurance that your environment is free from threat actors
Fully featured distrubuted NDR for on-premises and public cloud environments
A SecOps platform purpose-built for industrial and OT environments
Integrated endpoint agent providing deep visibility, response and forensics
Deploy honeypots and honeytokens and stay ahead of threat actors
24x7 security operations from our Australian SOC. AI investigates every alert, and experienced analysts validate findings and contain threats around the clock.
24x7 managed detection and response across endpoint, network, cloud, identity, and log sources
AI investigations and 24x7 MDR on the Microsoft Sentinel you already own
Eyes-on-glass SOC and continuous threat hunting
Expert hunters and AI agents find attacker activity your alerts missed
Quickly recover from cyber attacks and breaches
ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24x7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Monitoring, evidence and a 24x7 SOC in one platform
Compliance monitoring, evidence and board reporting
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
Articles on security operations, AI and compliance
Events, awards and company news
Read what our customers say about us
Solution briefs and datasheets
How we keep your data secure
Technical support and knowledge base
Guides, case studies, and advisories in one place
How AI agents investigate alerts and run security operations
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to incident response and digital forensics
Where SOAR playbooks fit and where AI agents take over
Free ebook: modern security operations with Microsoft Sentinel
How the framework is structured and what changes from the Essential Eight
November 10, 2026
November 6, 2026
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Embed security operations, threat intelligence and exposure data in your product
Sovereign SOC for Australian MSPs and MSSPs, with onshore analysts and client data
Set the rules for closing alerts automatically, with evidence checks and review
How MSPs deliver branded security monitoring with a SOC partner
ThreatDefence was an official partner of the Cyber Resilience Summit NSW, 29 October 2026 at Hilton Sydney.
Our team was back at BSides Canberra, and our cyber quiz was a hit again.
Two days in Perth with our partner Ever Nimble, on security operations and cyber resilience.
Sponsors of the AUSCERT Cyber Security Conference on the Gold Coast.
Sponsors of the Gartner Security & Risk Management Summit in March.
Sponsors of the Cyber Security for Critical Assets Summit in Perth, February 2026.
Expert conversations with speakers and attendees at CyberCon Melbourne 2025.
ASD Essentials compliance rests on evidence that each applicable cyber security action achieves its intended outcome, in every part of the organisation it covers.ThreatDefence automates security monitoring, compliance and cyber risk management in one platform. The data behind 24x7 detection and response also produces the evidence, ratings and board reporting for ASD Essentials and the Essential Eight.
The Australian Signals Directorate (ASD) published ASD Essentials on October 15, 2026 as a threat-informed cyber security framework. It extends the Essential Eight approach to enterprise IT, operational technology (OT) and cloud environments, and is written primarily for Commonwealth entities, critical infrastructure operators and large organisations.
ASD Essentials builds on the Essential Eight with a broader, domain-based approach to security outcomes. No regulation makes it mandatory yet, and existing Essential Eight obligations still have to be met.
The framework ties each security outcome to the work that achieves it and the systems that work has to protect.
The security outcomes an organisation is working towards, drawn from ASD’s Information Security Manual.
The administrative and technical work that achieves those outcomes.
The groups of business functions, systems and assets the actions apply to.
The enterprise IT chapter sorts the technical domains into priority phases. The phases are ASD’s recommended order of implementation. They are neither maturity levels nor compliance scores.
Boundary services and Identity services.
Critical processes and services and Privileged environments.
Business systems and User devices.
Governance and culture and Visibility and response, the capability domains that apply throughout implementation.
An action can be effective in one domain and only partially effective in another. An identity control deployed consistently for ordinary users, for example, may need different coverage or implementation in Privileged environments.
That is why assessment looks at the assets, risks and controls within each applicable domain. IT and security teams implement the protections: identity controls, system hardening, vulnerability treatment and access restrictions. Security operations supplies evidence from monitoring, detection and investigation, along with records of how control failures were handled.
Read: ASD Essentials Explained
Essential Eight compliance still applies wherever government policy, regulation or a contract references that framework. Adopting ASD Essentials does not remove those obligations.
The Essential Eight set a practical baseline for internet-connected IT networks. ASD has explained that it was never designed to cover enterprise mobility or operational technology, and its maturity model measures implementation against defined requirements.
ASD Essentials carries that approach into broader security outcomes, among them executive accountability, supplier assurance, AI accountability, credential exposure, logging, detection and incident response.
ASD has published no formal retirement date for the Essential Eight. Both frameworks remain available during the transition, and ASD recommends continuing approved Essential Eight uplift programs while reviewing alignment with the new guidance.
Existing controls and assessment evidence keep their value. An organisation with an Essential Eight Maturity Level Two assessment may already hold useful evidence for identity protection, patching, access control and other ASD Essentials actions. The earlier result does not automatically convert into an ASD Essentials effectiveness rating.
Priority phases also do a different job from maturity levels. A phase says which domains ASD recommends addressing first. An effectiveness rating says whether an action achieves its intended outcome in the domain assessed.
The order of work follows from that. Keep the required Essential Eight reporting going, identify the evidence that can be reused, then assess where the broader ASD Essentials outcomes need additional controls or validation. Existing regulatory obligations and organisational risk continue to guide implementation priorities.
Read: ASD Essentials vs the Essential Eight
Evidence for ASD Essentials compliance has to show whether security controls achieve their intended outcomes, including how they perform between formal assessments. An assessor looks at whether a control is implemented, whether it operates consistently and whether it stays effective over time. ASD’s transition guidance states that deployment alone does not demonstrate effectiveness.
deployment alone does not demonstrate effectiveness.
Configuration exports and previous assessments show what has been implemented. Operational records such as reviews, monitoring results, exceptions and remediation history help show whether the controls work consistently.
For an enterprise IT baseline, collection begins with Boundary services and Identity services, alongside Governance and culture and Visibility and response.
The table below gives examples for those domains. The collection methods are common practice rather than ASD requirements. The action IDs refer to ASD’s Indicators of Good Practice.
Label each item of evidence with the environment, the assessment period and the systems it covers. A dated configuration export or system-generated report is generally a stronger record than a single screenshot, because it can preserve the underlying settings for later review.
Where no direct export is available, a screenshot still serves, provided it identifies the tenant, scope and collection date.
The evidence also has to support the conclusion drawn from it. A Conditional Access export may show that a policy exists. Sign-in records help show how authentication operated during the assessment period. A vulnerability scan identifies exposure, and the remediation records show what happened to each finding.
Keep evidence gaps and control failures apart. Missing logs may stop an assessor from confirming effectiveness, but their absence does not automatically prove that the underlying technical control failed.
Explore ASD Essentials Monitoring and Reporting
See where you stand on the domains ASD asks organisations to address first. We rate each action against the evidence your environment produces today, and show which gaps carry the most risk.
Australian organisations still have to meet the cyber security requirements that apply to their sector. ASD Essentials adds guidance alongside those compliance requirements, and adopting it does not automatically satisfy existing regulation, government policy or contractual obligations.
The PSPF, relevant state policies, the SOCI risk management program rules and DISP continue to reference the Essential Eight. Evidence against those requirements is still needed while ASD Essentials is being examined. ASD Essentials explained covers the framework’s regulatory position, and ASD Essentials for government gives the Commonwealth and state context.
Large organisations are a primary audience for ASD Essentials. Their security programs, supplier contracts and customer assurance requests may already call for evidence that controls are implemented and operating effectively.
Service providers may need separate assessment evidence for each client, including records supporting the client’s supplier assurance activities. Monitoring coverage, findings and evidence have to stay attributable to the correct organisation.
It helps to keep a framework used to guide security improvements apart from an obligation that has to be proven to a regulator, customer or assessor.
Where a contract requires Essential Eight Maturity Level Two, an ASD Essentials effectiveness assessment is useful additional evidence, but it does not replace the required Essential Eight assessment.
Explore Critical Infrastructure Monitoring
An ASD Essentials baseline records how effective each applicable security action is today and lists the control and evidence gaps that need attention.
For enterprise IT, the first pass covers Boundary services and Identity services, together with the capability domains of Governance and culture and Visibility and response. The result is the starting position for remediation and ongoing monitoring.
Identify the relevant ASD Essentials chapter and the systems, assets and business functions covered by each applicable domain.
Existing asset inventories, system registers and architecture records can support this work. The scope separates the assets the assessment covers from those outside it, so a favourable result is not mistaken for organisation-wide coverage.
Record applicable government, regulatory and contractual requirements separately. Where an obligation references the Essential Eight, its assessment and reporting requirements remain in place.
Find where the evidence for each applicable action is held.
Common sources include identity platforms, endpoint security tools, network devices, cloud and SaaS services, vulnerability scanners and existing governance records.
Technical connections use authorised access and the security tools already deployed. Client administrators approve access to each source.
Connecting an existing tool may reduce the need to introduce another collection mechanism. A successful connection is no guarantee that every required log, configuration detail or historical record is available. A source connected this week, for example, may hold nothing from the earlier months of an assessment period.
Assess the applicable actions within each in-scope domain using the evidence collected.
For each action, the baseline records the effectiveness rating, the systems covered and the evidence behind the conclusion. A control that is effective, one that is partially effective and one the evidence cannot yet confirm each get a distinct finding.
A useful baseline record ties the assessment result to the work that follows:
The requirement being assessed and the assets it applies to.
The configuration, review, test or operational evidence used.
Whether the evidence shows the intended security outcome, and what remains uncertain.
The control change or additional evidence needed.
The team responsible for implementing or validating the improvement.
Separate missing evidence from missing or ineffective controls. A protection that works may only need more records before an assessor can confirm it. A proven control failure needs remediation.
Keep the relevant Essential Eight maturity results alongside the new baseline wherever existing obligations require them.
Evidence collection continues after the baseline. A change to users, infrastructure, applications, suppliers or security configurations can decide whether a control that was effective still is.
Security operations can identify relevant events, investigate suspicious activity, detect control failures and keep the records of response and remediation.
Regular reviews show which findings have been resolved, which remain open and whether the evidence supports an updated assessment.
When the organisation extends implementation into phases 2 and 3, the same approach applies to the additional domains. Existing evidence can be reused where it is still relevant, but effectiveness is considered afresh against the assets and risks of each domain.
The baseline is the starting position. Ongoing monitoring and reassessment show whether that position is held or improved.
ThreatDefence automates security monitoring, compliance and cyber risk management in one platform, with a 24x7 SOC behind it. ASD Essentials and Essential Eight compliance services run on that platform through continuous monitoring and assessment evidence.
The service supports every domain of the enterprise IT chapter, and its level of involvement depends on the controls being assessed.
Client teams remain responsible for implementing and maintaining technical controls. ThreatDefence monitors their effectiveness, investigates threats and records evidence that can support assessment and reporting.
Monitoring, compliance and cyber risk are often run as separate projects, each with its own tools and its own copy of the data. ThreatDefence runs them on the same telemetry.
Logs and telemetry from identity, endpoint, network, cloud and SaaS sources are collected, correlated and triaged 24x7 by AI and SOC analysts.
The same telemetry supplies evidence against ASD Essentials actions and Essential Eight strategies. Ratings update as the environment changes, which cuts the manual collection ahead of each assessment.
Open gaps, exposures and incidents roll up into a cyber risk view with owners and trends, ready for board reporting.
ThreatDefence connects with the security tools the organisation has already deployed. Its platform collects evidence from identity, endpoint, network, cloud and SaaS sources under one licence.
What is monitored, and the evidence that comes out of it, differs by domain.
These capabilities provide monitoring, investigation and supporting evidence. The assessment outcome still depends on the controls the organisation has implemented, their coverage and whether the available records show the intended security outcomes.
ThreatDefence’s SOC team is based in Australia and operates 24x7, with a 3 min average response time.
The SOC uses AI triage and human analysts to investigate alerts and escalate confirmed incidents to the client’s CISO or designated contact.
Detection content covers suspicious authentication, unauthorised changes, endpoint execution and network activity, with mappings to MITRE ATT&CK.
Within the authority approved by the client, analysts can isolate hosts, revoke sessions, disable accounts, remove MFA methods, block senders or IP ranges and reset passwords.
Threat hunting is included in the standard service, together with an incident response retainer and guaranteed SLAs.
Each investigation record covers the event, the assessment performed, any response taken and the resulting outcome. These records can support an evaluation of detection and response effectiveness.
ThreatDefence reports connect action and principle ratings with supporting evidence, remediation owners and trends over time.
Customers can review assessment findings alongside operational evidence, including investigation results and progress on identified issues.
They can also export investigation records for an assessor or retrieve them when leaving the service.
Where existing obligations still require Essential Eight maturity reporting, ThreatDefence supports that reporting alongside ASD Essentials effectiveness assessments.
Both frameworks can draw on the same underlying evidence. Their ratings are not treated as equivalent.
ThreatDefence provides Essential Eight and ASD Essentials compliance services in Sydney, Melbourne, Brisbane, Adelaide and Perth, as well as regional Australia.
The SOC team is based in Australia.
For Australian customers, data sovereignty and residency in Australia are guaranteed, including Australian data processing and AI processing.
Before a formal assessment, the free ASD Essentials Navigator lets organisations rate each action for their own environment and see how principles and domains roll up. Readers new to the framework can start with the five-minute ASD Essentials explainer, which walks through principles, actions, domains, priority phases and ratings.
Open the ASD Essentials Navigator Start the 5-Minute Explainer
The guides below go further into the requirement behind an assessment finding, the domain it sits in and the work that follows the initial baseline.
The framework guides explain how ASD Essentials is structured. The domain and security operations guides give more detail on the controls, monitoring and evidence for each area.
ASD Essentials explained and Essential Eight vs ASD Essentials: what changed and how to transition.
ASD Essentials assessment and checklist and monitoring, reporting and compliance software.
enterprise IT, cloud, operational technology and critical infrastructure and Microsoft 365, Intune and Sentinel.
Governance and culture, Visibility and response, Boundary services, Identity services, Critical processes and Privileged environments and Business systems and User devices.
SOC, MDR and incident response, SIEM, detection rules and threat hunting, Microsoft Sentinel and NDR.
government and the PSPF, critical infrastructure and SOCI, small business and cyber insurance and MSPs.
ASD Essentials vs ISO 27001, NIST CSF and SOC 2 and the Essential Eight and its maturity model.
See how ThreatDefence automates security monitoring, compliance and cyber risk management in one platform.
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
Δ
ASD Essentials compliance means showing that each applicable action achieves its intended security outcome in the domains where it applies. Assessment uses evidence of implementation, coverage and effectiveness. Results are read at action, principle and domain level, with no single figure like an Essential Eight maturity level.
ASD Essentials is not yet mandated by regulation. Existing Essential Eight requirements still have to be met while the new framework is used to assess broader security outcomes.
No. ASD does not operate an organisational certification scheme under either framework, and ThreatDefence does not certify compliance.
ThreatDefence supports assessment preparation, evidence collection, continuous monitoring and reporting. Its records can be provided to an independent assessor where government policy, regulation or a contract requires one.
An assessment conclusion depends on the applicable requirements, the scope reviewed, the controls implemented and the evidence available. A monitoring service does not replace the organisation’s assessment responsibilities.
For enterprise IT, a phase 1 baseline covers Boundary services and Identity services, together with Governance and culture and Visibility and response.
The assessment identifies the applicable actions, records their effectiveness and lists the evidence and control gaps. Each finding is linked to its supporting records and the work needed to address it.
Where an organisation must continue reporting Essential Eight maturity, that assessment remains separate. The same configuration and operational evidence may contribute to both approaches.
The timeline depends on the size of the environment, the number of evidence sources, the availability of existing records and the time needed to approve access.
Organisations with asset inventories already in place, connected security tools and current assessment evidence may need less initial collection work. Environments with fragmented systems or incomplete records may need additional scoping and validation.
ThreatDefence agrees the timeline before beginning the baseline, based on the systems and evidence included.
Yes. ThreatDefence works with existing identity, endpoint, network, cloud and SaaS security technologies and does not require their replacement to begin collecting supported evidence.
The baseline identifies the information available through current integrations and the gaps that remain. Some gaps may close once existing records are switched on or kept for longer, while others may need changes to controls or collection.
The organisation decides how to address those findings while maintaining the controls already in place.
Yes, ThreatDefence supports every domain in the enterprise IT chapter, although its involvement differs according to the controls and evidence required.
The 24x7 SOC primarily supports Visibility and response through logging, detection, investigation, incident response and threat hunting. Other domains benefit from monitoring and evidence such as MFA coverage, administrative activity, vulnerability findings, backup job status and configuration changes.
Client teams remain responsible for implementing and maintaining technical protections, including patching, application control and backups.
Yes. ThreatDefence supports OT environments through passive network monitoring and associated security operations.
The ASD Essentials OT chapter places Boundary services and Critical processes and services in phase 1, treats every device in an OT system as privileged and excludes User devices from its technical domain mapping.
ThreatDefence provides network detections for reconnaissance, command and control beaconing, lateral movement and exfiltration. Operational response is subject to explicit approval.
Yes. ThreatDefence supports cloud and SaaS environments by collecting relevant audit and security evidence and helping document the controls within the organisation’s responsibility.
The ASD Essentials cloud chapter addresses environments delivered entirely through SaaS and PaaS services and identifies actions associated with customer, supplied or provider responsibilities.
Cloud audit records can help show customer-side activity and control operation, while provider assurance records support assessment of responsibilities outside the customer’s direct control. Coverage depends on the services and evidence available.
Pricing depends on the environment being assessed, the connected evidence sources, applicable domains and the level of ongoing security operations required.
ThreatDefence’s platform modules are included under one licence. The initial phase 1 baseline sets out the relevant assessment scope and evidence gaps before the ongoing service scope is agreed.
Where the 24x7 SOC operates the Visibility and response function, monitoring and investigation responsibilities form part of that scope. Pricing reflects the agreed environment and service rather than an assumed organisation-wide compliance rating.
ASD Essentials Explained: Framework, Chapters and Enterprise IT
"Essential Eight vs ASD Essentials: What Changed and How to Transition"
ASD Essentials Assessment and Checklist