AI agents investigate every alert, add context, and prepare cases for response, on a full-stack SecOps platform that captures and correlates all your security data.
Cloud-based SIEM platform providing visibility across all your data sources
Every alert investigated, with a verdict and the evidence behind it
Manage your external footprint, publicly available data, and Dark Web leaks
Log management and threat detection across any of your log sources
Get ultimate assurance that your environment is free from threat actors
Fully featured distrubuted NDR for on-premises and public cloud environments
A SecOps platform purpose-built for industrial and OT environments
Integrated endpoint agent providing deep visibility, response and forensics
Deploy honeypots and honeytokens and stay ahead of threat actors
24x7 security operations from our Australian SOC. AI investigates every alert, and experienced analysts validate findings and contain threats around the clock.
24x7 managed detection and response across endpoint, network, cloud, identity, and log sources
Eyes-on-glass SOC and continuous threat hunting
Expert hunters and AI agents find attacker activity your alerts missed
Quickly recover from cyber attacks and breaches
ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24x7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Essential Eight monitoring, reporting, and evidence for ongoing compliance
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
Articles on security operations, AI and compliance
Events, awards and company news
Read what our customers say about us
Solution briefs and datasheets
How we keep your data secure
Technical support and knowledge base
Guides, case studies, and advisories in one place
How AI agents investigate alerts and run security operations
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to incident response and digital forensics
Where SOAR playbooks fit and where AI agents take over
November 2, 2026
October 31, 2026
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Embed security operations, threat intelligence and exposure data in your product
Sovereign SOC for Australian MSPs and MSSPs, with onshore analysts and client data
Set the rules for closing alerts automatically, with evidence checks and review
How MSPs deliver branded security monitoring with a SOC partner
ThreatDefence was an official partner of the Cyber Resilience Summit NSW, 29 October 2026 at Hilton Sydney.
Our team was back at BSides Canberra, and our cyber quiz was a hit again.
Two days in Perth with our partner Ever Nimble, on security operations and cyber resilience.
Sponsors of the AUSCERT Cyber Security Conference on the Gold Coast.
Sponsors of the Gartner Security & Risk Management Summit in March.
Sponsors of the Cyber Security for Critical Assets Summit in Perth, February 2026.
Expert conversations with speakers and attendees at CyberCon Melbourne 2025.
Meet ThreatDefence at LGIT2026, the Local Government IT Conference, 4 to 6 November at Pacific Bay Resort, Coffs Harbour. See how councils get 24x7 security operations, AI-powered investigation, and Essential Eight reporting without building a SOC.
Meet our team at LGIT2026 in Coffs Harbour, or schedule a demo at a time that suits you.
Δ
ThreatDefence is a Silver Sponsor of LGIT2026, the 27th Local Government IT Conference, hosted by the City of Coffs Harbour. Council IT leaders from across Australia meet over three days of keynotes, council case studies, and a trade exhibition.
We are returning to Coffs Harbour after sponsoring LGIT 2023. Book a time with our team, or find us at the conference.
Book a meeting
Council IT teams look after large, complex environments, often with small teams. Our Australian-based SOC combines AI investigation with experienced analysts to detect, assess, and contain threats around the clock, including weekends and public holidays.
AI agents investigate incoming alerts, while analysts validate findings, resolve uncertainty, and coordinate escalations. Your team receives clear assessments with supporting evidence and recommended actions.
Revoke sessions, isolate endpoints, and block malicious activity across connected tools. Agreed permissions, approval requirements, and scope limits govern each response action.
Scheduled and intelligence-led hunts search for credential misuse, persistence, and lateral movement that existing detections may miss.
Containment, forensic investigation, and recovery support are part of the service, with a DFIR retainer included.
Show councillors, auditors, and executives where your controls stand. Essential Eight monitoring and reporting collects evidence continuously across all eight strategies and flags control drift as it happens.
Reports on maturity, control gaps, and progress, built from your own operational data.
Eligible data breach detection and Notifiable Data Breaches support under the Privacy Act, with DFIR when you need it.
Your data and AI processing stay in Australia, with 100% Australian data sovereignty.
AI agents investigate alerts, add context, and prepare cases for response. Your team gets the evidence to act, with approvals and automation under your control.
Agents investigate every alert across your connected tools, including low-severity signals. They query live data and follow suspicious activity to establish what happened.
Asset details, identity activity, threat intelligence, and previous cases enrich each alert. Evidence from across your tools helps distinguish expected behavior from potential compromise.
Suspicious and uncertain findings become cases with clear verdicts, severity, and supporting evidence. Escalations reach the right analysts with recommended next steps ready.
Attacker actions are recorded in the case, with containment steps prepared in sequence. Revoke sessions, isolate endpoints, and block malicious activity within approved limits or after analyst approval.
Connect the tools that raise most of your alerts and watch the agents investigate them in co-pilot mode, with every query on the record.
Lookalike websites and fake council domains target residents and staff. Attack surface management and brand protection finds internet-facing assets, lookalike domains, cloned sites, and leaked credentials, and our SOC investigates and acts on the findings.
Everything below is included under a single license, with nothing for you to deploy or maintain.
Logs from identity, endpoint, email, cloud, network, and on-premises sources correlated in one place, with retention and search that hold up in a real investigation.
Weeks of network evidence for hunting, with command-and-control, lateral movement, and remote access anomalies surfaced from traffic.
Deep telemetry from your EDR or our agent, plus live response and forensic collection when an investigation needs to go further.
Continuous review of configuration, exposure, and privileged activity across Microsoft 365, Entra ID, Azure, AWS, and SaaS.
Your internet-facing footprint mapped and monitored, including exposed services, expired certificates, and forgotten infrastructure.
Passive monitoring of industrial networks, with protocol-aware detection and asset discovery that never touches plant equipment.
Hundreds of prebuilt connectors for the identity, endpoint, cloud, network, and business platforms you already run.
Lookalike domains, spoofed logins, and impersonation of your brand detected and taken down before anyone falls for them.
Decoy hosts, credentials, and documents that only an intruder would touch, producing alerts with almost no false positives.
Enrichment and first-pass triage handled automatically, so analyst time goes to the alerts that carry real risk.
Essential Eight, SOCI, and Privacy Act evidence produced from the same records the SOC works from.
Containment, forensic investigation, and recovery support from the analysts who watch your environment, included in the service.
Councils and organizations in Australia and abroad rely on ThreatDefence for visibility, detection, and response. Read how North Sydney Council, Campbelltown City Council, and Ballina Shire work with us.
ThreatDefence not only gave us visibility into our security posture, but also provided actionable intelligence to help us address issues that we didn’t even know existed.
The most valuable capability is probably the collation of all the alerts into one spot, and the filtering of all the noise.
They’re one of my favourite vendors. They have the backend technology, telemetry, and capability to identify threats quickly.
Faster investigations. Clear evidence. Coordinated response.
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
At LGIT2026, 4 to 6 November 2026 at Pacific Bay Resort, Coffs Harbour. Book a time with the form on this page, or find our team at the conference.
No. ThreatDefence works with your existing SIEM, EDR, identity, email, cloud, and network tools through their APIs. Using our SIEM is optional.
In Australia, with 100% Australian data sovereignty for Australian customers.
24x7 monitoring, alert triage and investigation, threat hunting, incident response with a DFIR retainer, reporting, and access to the customer portal, under fixed monthly pricing.
Yes. Continuous monitoring and evidence collection across all eight strategies, with reports on maturity, control gaps, and drift.
Yes. A four-week SIEM and SOC trial is available at no cost, onboarded in hours with read-only access, and includes a cyber risk report you keep.