AI agents investigate every alert, add context, and prepare cases for response, on a full-stack SecOps platform that captures and correlates all your security data.
Cloud-based SIEM platform providing visibility across all your data sources
Every alert investigated, with a verdict and the evidence behind it
Manage your external footprint, publicly available data, and Dark Web leaks
Log management and threat detection across any of your log sources
Get ultimate assurance that your environment is free from threat actors
Fully featured distrubuted NDR for on-premises and public cloud environments
A SecOps platform purpose-built for industrial and OT environments
Integrated endpoint agent providing deep visibility, response and forensics
Deploy honeypots and honeytokens and stay ahead of threat actors
24x7 security operations from our Australian SOC. AI investigates every alert, and experienced analysts validate findings and contain threats around the clock.
24x7 managed detection and response across endpoint, network, cloud, identity, and log sources
AI investigations and 24x7 MDR on the Microsoft Sentinel you already own
Eyes-on-glass SOC and continuous threat hunting
Expert hunters and AI agents find attacker activity your alerts missed
Quickly recover from cyber attacks and breaches
ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24x7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Essential Eight monitoring, reporting, and evidence for ongoing compliance
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
Articles on security operations, AI and compliance
Events, awards and company news
Read what our customers say about us
Solution briefs and datasheets
How we keep your data secure
Technical support and knowledge base
Guides, case studies, and advisories in one place
How AI agents investigate alerts and run security operations
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to incident response and digital forensics
Where SOAR playbooks fit and where AI agents take over
Free ebook: modern security operations with Microsoft Sentinel
November 4, 2026
November 3, 2026
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Embed security operations, threat intelligence and exposure data in your product
Sovereign SOC for Australian MSPs and MSSPs, with onshore analysts and client data
Set the rules for closing alerts automatically, with evidence checks and review
How MSPs deliver branded security monitoring with a SOC partner
ThreatDefence was an official partner of the Cyber Resilience Summit NSW, 29 October 2026 at Hilton Sydney.
Our team was back at BSides Canberra, and our cyber quiz was a hit again.
Two days in Perth with our partner Ever Nimble, on security operations and cyber resilience.
Sponsors of the AUSCERT Cyber Security Conference on the Gold Coast.
Sponsors of the Gartner Security & Risk Management Summit in March.
Sponsors of the Cyber Security for Critical Assets Summit in Perth, February 2026.
Expert conversations with speakers and attendees at CyberCon Melbourne 2025.
Expose intruders with decoy systems, credentials, and data.
Intruders search for systems, credentials, and valuable information. ThreatDefence places realistic decoys along those paths, creating opportunities to detect suspicious activity before an attacker reaches further into your environment.
Deception findings feed directly into the AI SOC platform. Agents gather supporting evidence, and our 24x7 SOC investigates and coordinates response under your procedures.
Interactions with carefully placed decoys provide a focused signal for investigation, with the source and activity recorded.
Decoy credentials help identify attempts to reuse information gathered from files, scripts, and other locations.
Identify systems exploring decoy services, attempting authentication, or accessing planted resources.
Use decoy repositories, portals, and documents to surface suspicious access that needs closer assessment.
Decoys resemble resources an attacker might want to access. Their placement and monitoring turn interactions into evidence your SOC can investigate.
Deploy suitable systems, services, accounts, and data in locations relevant to your environment and detection priorities.
Record connection attempts, authentication activity, resource access, or supported token triggers.
Connect the finding with endpoint, identity, and network evidence to establish who or what initiated it.
Prepare containment through connected tools, with permissions and approvals enforced by the platform.
Known scanners, administrative tools, and testing activity are accounted for during setup and tuning.
Different decoys reveal different behavior. Combine them around the systems, access paths, and information you want to protect.
Honeypots imitate servers, workstations, and network services, recording scans, connections, and supported interactions.
Planted credentials reveal attempted use against monitored services, helping identify credential harvesting and reuse.
Monitored accounts and service identities attract suspicious authentication or service-ticket activity without granting access to production resources.
Instrumented documents can raise alerts when supported interactions trigger their monitoring mechanism.
Portals, repositories, and data stores provide monitored targets for suspicious exploration and access.
Planted references, saved connections, and file paths direct attention toward monitored decoys.
Match decoys to the names, services, and resources people would expect in your environment. Position them around likely discovery and access paths, with clear separation from production resources.
WS-FIN-07
WS-ENG-03
creds.txt
SRV-FS-01
FS-ARCHIVE-02
SRV-SQL-04
DC-01
svc_backup_adm
Kerberos SPN
hr-portal-legacy
git/payments-core
Q3-board-pack.docx
09:14:22
09:14:31
09:14:35
For example: A finance workstation uses a decoy account to access a honeypot file server and enumerate its shares. The interaction opens a case with the source host, account, timing, and available activity records.
The SOC can investigate the originating workstation and related access without treating the decoy event as an isolated alert.
Deception adds visibility into the steps an intruder takes while looking for a way forward.
Decoy services record scanning, enumeration, and connection attempts from systems exploring the network.
Monitored credentials expose attempts to authenticate using planted account details.
Decoy administrative identities and service accounts help surface suspicious interest in higher levels of access.
Decoy files and applications reveal interactions with resources designed to attract attention.
These findings become more useful when connected. A decoy login from a workstation already showing suspicious execution deserves a different response from an approved scanner touching a new service.
A person with legitimate access can still misuse it. Deception creates monitored resources that help identify activity requiring explanation.
Place realistic decoy records around sensitive business areas such as finance, personnel information, and intellectual property.
Use decoy repositories and planted references to investigate unexpected exploration of source code or secrets.
Investigate supported document triggers with the available source, timing, and related activity.
Review permissions, role, access history, and business purpose before reaching a conclusion about intent.
AI agents review deception findings and gather the activity around them. They query endpoint history, examine authentication records, and check related network connections.
Analysts receive an assessment with supporting evidence, unresolved questions, and recommended actions.
Identify the host, account, and available process evidence behind the interaction.
Search for related access, suspicious execution, external connections, and use of the same credential elsewhere.
Recommend appropriate actions, such as host isolation or account protection, for approval or execution within authorized limits.
Keep decoy events, queries, findings, decisions, and response outcomes together in the case.
Deception is part of the ThreatDefence AI SOC platform. Findings share the same security context, case management, response controls, and reporting as your other detections.
Combine decoy interactions with network, endpoint, identity, and cloud evidence to understand how access began and which other systems need investigation. Use validated findings to improve detections and guide future hunts.
Explore the AI SOC Platform
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
Δ
Hacker deception uses monitored decoy systems, services, credentials, and data to reveal suspicious activity. Interactions generate evidence that helps security teams investigate potential intruders or misuse of access.
A honeypot is a decoy system or service, such as a file server. A honeytoken is planted information, such as a credential or instrumented document, that generates a finding when its monitoring mechanism is triggered.
Scanners, administrators, and authorized tests can interact with decoys. Careful placement, business context, and tuning help distinguish those activities from suspicious behavior.
Some may. Realistic configuration and placement make decoys more relevant to your environment, but deception is one part of detection coverage rather than a guarantee that every attacker will engage.
Decoy services are separated from production resources, and planted accounts should have no production privileges. Deployment is planned around your environment, including naming, access controls, and approved monitoring locations.
No. Detection depends on the document type, monitoring method, and how it is handled. A supported open or callback may trigger an alert, while copying a file alone may not.
AI agents gather related evidence and prepare findings for our SOC. Analysts assess the activity and coordinate response through the platform under your agreed permissions and procedures.
It can surface suspicious interactions with decoy information and resources. Investigators assess those events alongside the person’s role, permissions, and activity before drawing conclusions.
Timing depends on the decoys selected and the environment. Deployment starts once locations, access requirements, and monitoring arrangements are agreed, with tuning as legitimate activity is observed.