AI agents investigate every alert, add context, and prepare cases for response, on a full-stack SecOps platform that captures and correlates all your security data.
Cloud-based SIEM platform providing visibility across all your data sources
Every alert investigated, with a verdict and the evidence behind it
Manage your external footprint, publicly available data, and Dark Web leaks
Log management and threat detection across any of your log sources
Get ultimate assurance that your environment is free from threat actors
Fully featured distrubuted NDR for on-premises and public cloud environments
A SecOps platform purpose-built for industrial and OT environments
Integrated endpoint agent providing deep visibility, response and forensics
Deploy honeypots and honeytokens and stay ahead of threat actors
24x7 security operations from our Australian SOC. AI investigates every alert, and experienced analysts validate findings and contain threats around the clock.
24x7 managed detection and response across endpoint, network, cloud, identity, and log sources
AI investigations and 24x7 MDR on the Microsoft Sentinel you already own
Eyes-on-glass SOC and continuous threat hunting
Expert hunters and AI agents find attacker activity your alerts missed
Quickly recover from cyber attacks and breaches
ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24x7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Monitoring, evidence and a 24x7 SOC in one platform
Compliance monitoring, evidence and board reporting
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
Articles on security operations, AI and compliance
Events, awards and company news
Read what our customers say about us
Solution briefs and datasheets
How we keep your data secure
Technical support and knowledge base
Guides, case studies, and advisories in one place
How AI agents investigate alerts and run security operations
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to incident response and digital forensics
Where SOAR playbooks fit and where AI agents take over
Free ebook: modern security operations with Microsoft Sentinel
How the framework is structured and what changes from the Essential Eight
November 13, 2026
November 10, 2026
November 6, 2026
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Embed security operations, threat intelligence and exposure data in your product
Sovereign SOC for Australian MSPs and MSSPs, with onshore analysts and client data
Set the rules for closing alerts automatically, with evidence checks and review
How MSPs deliver branded security monitoring with a SOC partner
ThreatDefence was an official partner of the Cyber Resilience Summit NSW, 29 October 2026 at Hilton Sydney.
Our team was back at BSides Canberra, and our cyber quiz was a hit again.
Two days in Perth with our partner Ever Nimble, on security operations and cyber resilience.
Sponsors of the AUSCERT Cyber Security Conference on the Gold Coast.
Sponsors of the Gartner Security & Risk Management Summit in March.
Sponsors of the Cyber Security for Critical Assets Summit in Perth, February 2026.
Expert conversations with speakers and attendees at CyberCon Melbourne 2025.
Grow your security business with a complete SecOps platform and 24x7 SOC. AI agents investigate alerts, our analysts respond, and your team stays in control of each client’s service.
Protect clients against ransomware, business email compromise, and attacks across their environments. ThreatDefence brings the technology, people, and processes to deliver security operations without building a 24x7 team.
Many small and mid-sized businesses cannot operate that capability themselves. Your service gives them continuous monitoring, investigation, and response, configured around their needs.
Cloud-based endpoint, network, identity, and cloud monitoring, with detection, investigation, and response ready from day one.
Manage all clients on one multi-tenant platform, with every feature under a single license.
Cyber security experts become part of your team and act when threats need attention.
Set each client’s escalation paths, response authority, and approval requirements.
Our SOC-as-a-Service combines continuous monitoring with analysts who investigate and respond. Use our team for the whole operation or for specialist support alongside yours.
Our SOC has an average response time of 3 minutes.
Security events are processed, correlated, and assessed in real time, 24x7.
Specialists work alongside your team on investigations, containment, and recovery.
Real-world attack scenarios guide detection beyond simple alerts and thresholds.
Work directly with threat hunters, incident responders, and platform engineers to resolve requests in real time.
AI agents investigate every incoming alert, gather evidence across connected tools, and assess the activity in the client’s context. Verdicts include confidence, severity, MITRE ATT&CK mapping, and supporting evidence.
Supported benign findings close under approved policies. Suspicious and uncertain cases reach analysts with the investigation, timeline, and recommended actions prepared.
Follow related activity across accounts, endpoints, email, cloud, and network, with queries and findings recorded in the case.
Document attacker actions and assemble containment steps for approval or execution within the client’s limits.
Run scheduled and intelligence-led hunts across retained data, directed by experienced hunters. Scheduled hunting and monthly hunting reports are part of the standard service.
Propose new rules, tuning changes, and targeted exclusions from investigation outcomes, with evidence for review.
Connect analysts’ own AI agents through the platform’s MCP server to query data, run reusable skills, and prepare reports within their permissions.
SOC as a service for MSSPs and MSPs can support different teams and operating hours. Set coverage per client and combine arrangements across your customer base.
As your practice grows, take on more operations without changing platforms. ThreatDefence can continue supporting overnight coverage, specialist investigations, and incidents.
We monitor, investigate, and respond 24x7. Your team receives escalations and manages client communication.
You cover business hours; we cover nights, weekends, and public holidays.
Your team handles first-line alerts and client requests, with ours supporting complex cases and incidents.
Both teams work the same cases in the same console, with responsibilities agreed per client.
Your engineers and our analysts work from the same case record, which brings together evidence, queries, timelines, decisions, and actions. Ownership, approvals, and progress stay visible across teams and shifts.
An incident response retainer is included. When a case exceeds routine containment, our responders work with your technical team without waiting for a separate contract.
Continuous forensic recording preserves activity before an incident is discovered, giving investigators a history to work from.
Confirmed incidents reach your PSA with the verdict, evidence, actions taken, and next steps. Escalation follows each client’s contact order and response procedures.
Every action is logged, with recovery and rollback controls where applicable. Authorized users can reduce permissions or suspend individual workflows.
Choose co-pilot recommendations, approval before execution, or autonomous action within agreed limits.
Disable accounts, revoke sessions, and isolate endpoints within the client’s approved scope.
Contact on-call engineers, your service desk, or client representatives in the agreed sequence.
Two-way ConnectWise, Autotask, HaloPSA, and ServiceNow synchronization keeps ticket status and notes current.
Include the assessment, supporting findings, completed actions, and recommended next steps.
Guaranteed service levels are written into your partner agreement and measured for every client. Track acknowledgment and response by severity, incidents contained, and actions taken across your practice.
Quality dashboards also show investigation coverage, MTTR, analyst agreement, overrides, incorrect closures, and time saved. Review the cases behind the figures and use analyst feedback to improve skills, context, and closure policies.
Automated weekly and monthly reports reflect each client’s operational and compliance needs. Send your logo once, and ThreatDefence applies your branding.
Show current risks, control gaps, and priorities.
Summarize investigations, incidents, response actions, and outstanding issues.
Track changes in exposure, alert activity, and service performance.
Support reviews against ISO 27001, PCI DSS, Essential Eight, and other frameworks.
Record what was searched, what was found, and any limits on coverage.
For branded portals and alert emails, explore the white label SOC platform.
Manage hundreds of client tenants from one partner workspace. Every platform feature supports multi-tenancy, while each client’s data, users, credentials, permissions, response rules, and reports remain separate.
Prioritize work across clients by severity and SLA, with AI verdicts and evidence attached.
Search authorized environments together to identify affected clients and reduce MTTD and MTTR.
Give analysts, engineers, and client users access appropriate to their roles and assigned tenants.
Generate each client’s reports from its own records.
Give clients access to their security posture, incidents, and reports.
Create and manage tenants programmatically.
Your own environment is covered too, including RMM tools, privileged accounts, and administrative activity.
Explore AI SOC for MSSPs.
Our platform includes next-generation SIEM, NDR, endpoint visibility, vulnerability management, hacker deception, and threat intelligence. Connect firewalls, security gateways, antivirus, EDR, data loss prevention, and other security systems your clients already run, plus custom applications and log sources that add useful security evidence.
Those connections create an AI layer across the existing tools, giving agents and analysts the evidence to follow an attack across systems. Clients keep their technology while your team gains a shared investigation workspace.
Deploy the ThreatDefence agent in a few clicks and start collecting endpoint logs immediately. Investigate processes, files, and user activity, preserve forensic evidence, and coordinate response from the same platform.
AI agents use endpoint findings alongside identity, email, and network evidence to establish what happened and which systems need attention.
Explore endpoint visibility →
Monitor Microsoft 365, Azure, AWS, and Google Cloud for threats, vulnerabilities, and misconfigurations. Ongoing assurance and cloud cyber risk management help your team identify weaknesses before they become incidents.
Sign-ins, mailbox activity, and application consents give investigators the context to assess account takeover and business email compromise.
Explore cloud assurance →
Watch Microsoft 365 identities 24x7 for account takeover, session hijacking, risky app consents, and privilege changes, with response inside each client's agreed authority.
Start new clients with a forensic scan of six months of Microsoft 365 activity to uncover historic compromise, persistent access, and security gaps.
Explore ITDR →
Uncover lateral movement and insider threats with network detection, session evidence, and packet analysis.
Agents connect network findings with endpoint and identity activity, helping analysts assess the scope and prepare targeted containment.
Explore NDR →
Discover each client's internet-facing systems, lookalike domains, and impersonation, with every finding tied to its asset and owner.
Findings from the dark web, social media, and integrated intelligence sources are matched to client accounts and systems, and the SOC validates each one before action.
Explore attack surface management →
Give each client a risk score built from their own operational data: exposed assets, leaked credentials, identity weaknesses, and compliance gaps.
Weekly and monthly reporting measures progress against compliance frameworks, so clients see what changed and what to fix first.
Explore cyber risk management →
Deception records attacker interactions, giving the SOC high-fidelity evidence to investigate and act on.
Explore hacker deception →
Explore the SecOps Platform
Watch AI agents triage alerts across your client tenants, with every verdict, action, and escalation on the record.
Your clients need to know someone is watching, can explain what happened, and will help them respond. Without that visibility and support, a breach can consume weeks of specialist time and delay recovery.
Give them an established security operations service before an incident happens.
Monitor systems and networks for malicious activity, around the clock.
Notify clients when compromised user accounts are found.
Preserve security events for faster investigations and breach containment.
Provide response and guidance throughout an incident.
Offer further capabilities through the same platform, with each client’s findings available to the SOC.
Microsoft 365 forensic scans, risky application review, and session controls.
Attack surface management, vulnerability findings, and leaked credentials.
Lookalike domains, cloned sites, and impersonation findings.
Visibility into AI tools in use and the data shared with them.
Client data and AI processing remain in the client’s region. The platform runs in Australia and the United States. Australian clients receive guaranteed data sovereignty and residency, with the SOC team based in Australia.
ThreatDefence is ISO 27001 and PCI DSS certified, with a SOC 2 report.
Each client’s data, credentials, agent memory, and case records stay separate.
Investigations, response actions, and approvals remain available for review.
Launch with the people, processes, technology, sales collateral, and MSSP service packages already in place. Our experts help your team build its security program, onboard clients, and support new opportunities.
Access every feature from the start with no minimum commitment, and pay as clients join.
Every SecOps capability is priced per user per month, with no charge on log volume.
Set your client prices and package the modules each client needs.
Get help setting up the service and onboarding your first clients.
Work with our team on proposals, pricing guidance, and technical presales.
The cloud-based platform is ready to deploy across endpoint, network, syslog, cloud, and other log sources. Add clients as your business grows.
Start collecting data and producing detections without a lengthy platform build. Ready-to-go integrations and automated deployment help your team bring clients into the service quickly.
Roll out agents through common RMM tools.
Deploy in seconds without affecting user productivity.
Connect cloud services, syslog, and existing security tools.
Assess and report on cloud, endpoint, and network assets.
Search and report across authorized tenants.
Start with threat intelligence, dark web monitoring, and vulnerability assessments.
The platform is cloud-based and ready for your team and clients to use. Connect sources, establish visibility, and act on the findings.
Watch a short demo of connecting Microsoft 365, EDR, and endpoint agents. Set up the client’s tenant, sources, procedures, and permissions, then manage its service from the partner workspace.
Explore the partner workspace, client views, and security operations tools in the interactive platform tour.
See how partners use ThreatDefence to build and deliver managed detection and response.
My greatest fear as an MSP owner isn’t that we won’t receive the alert, it’s that we’ll receive so many that we’ll miss something. ThreatDefence gives me confidence we won’t miss something.
We knew we needed to get real visibility into our customers’ systems and ThreatDefence delivered a great set of technical capabilities, fantastic innovation, and enabled us to build authentic and true MDR services without compromising on quality.
I cannot endorse this product enough! ThreatDefence provides a top-class solution that continuously finds and clearly defines our top risks. Excellent integration capabilities and tailored functionality make it a winner.
We wanted to innovate and provide the best cyber defense services to our customers. With ThreatDefence, we were able to launch innovative, authentic, and game-changing SecOps services that leave our customers thrilled.
Ever Nimble grew from a cyber-focused MSP into a full MSSP, with offices in Australia, the UK, and Canada. Its monthly service provides 24x7 monitoring across every client log source. Read the Ever Nimble case study.
See ThreatDefence working on your own infrastructure and one or two clients. We set up a multi-tenant instance, onboard the data, and give your team access to every dashboard, alert, report, and the 24x7 SOC.
Continue monthly if it fits, with the first month free. An NFR license lets you use the platform internally in your business.
The MSP security guide covers service planning, while the guide to white-label SOC pricing models explains pricing approaches and margins.
Become a Partner
Tick the NFR box to start using ThreatDefence in your own environment for free.
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or resellerRequest an NFR license for our own environment
Δ
A managed SOC for MSPs provides 24x7 monitoring, investigation, and response across client environments. ThreatDefence supplies the platform and analysts, while you retain the client relationship and choose which work your team handles. Our managed SOC for MSSPs also supports existing SOC teams with AI triage, co-managed coverage, and specialist escalation.
Yes. Coverage is set per client. Your team can handle business hours while ours covers nights, weekends, and public holidays.
Yes. Connect firewalls, security gateways, antivirus, EDR, data loss prevention, cloud services, and custom sources. Clients keep their existing tools, with AI agents and analysts using evidence from across them.
ConnectWise, Autotask, HaloPSA, and ServiceNow, with two-way synchronization of ticket status and notes. Escalations include the verdict, evidence, actions taken, and next steps.
Yes. It includes containment, root cause investigation, evidence collection, forensic analysis, and a post-incident review, without needing to arrange a new contract during the incident.
Service levels are guaranteed in your partner agreement and reported for every client. The average response time is 3 minutes.
No. Every SecOps capability is licensed per user per month, with no charge on log volume.
For Australian clients, the SOC team is based in Australia, with guaranteed data sovereignty and residency. The SOC operates 24x7, and client data and AI processing stay in the client’s region.
Run a proof of value on your infrastructure and one or two clients, with the first month free. An NFR license and interactive platform tour are also available.