AI agents investigate every alert, add context, and prepare cases for response, on a full-stack SecOps platform that captures and correlates all your security data.
Cloud-based SIEM platform providing visibility across all your data sources
Every alert investigated, with a verdict and the evidence behind it
Manage your external footprint, publicly available data, and Dark Web leaks
Log management and threat detection across any of your log sources
Get ultimate assurance that your environment is free from threat actors
Fully featured distrubuted NDR for on-premises and public cloud environments
A SecOps platform purpose-built for industrial and OT environments
Integrated endpoint agent providing deep visibility, response and forensics
Deploy honeypots and honeytokens and stay ahead of threat actors
24x7 security operations from our Australian SOC. AI investigates every alert, and experienced analysts validate findings and contain threats around the clock.
24x7 managed detection and response across endpoint, network, cloud, identity, and log sources
AI investigations and 24x7 MDR on the Microsoft Sentinel you already own
Eyes-on-glass SOC and continuous threat hunting
Expert hunters and AI agents find attacker activity your alerts missed
Quickly recover from cyber attacks and breaches
ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24x7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Monitoring, evidence and a 24x7 SOC in one platform
Compliance monitoring, evidence and board reporting
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
Articles on security operations, AI and compliance
Events, awards and company news
Read what our customers say about us
Solution briefs and datasheets
How we keep your data secure
Technical support and knowledge base
Guides, case studies, and advisories in one place
How AI agents investigate alerts and run security operations
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to incident response and digital forensics
Where SOAR playbooks fit and where AI agents take over
Free ebook: modern security operations with Microsoft Sentinel
How the framework is structured and what changes from the Essential Eight
November 13, 2026
November 10, 2026
November 6, 2026
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Embed security operations, threat intelligence and exposure data in your product
Sovereign SOC for Australian MSPs and MSSPs, with onshore analysts and client data
Set the rules for closing alerts automatically, with evidence checks and review
How MSPs deliver branded security monitoring with a SOC partner
ThreatDefence was an official partner of the Cyber Resilience Summit NSW, 29 October 2026 at Hilton Sydney.
Our team was back at BSides Canberra, and our cyber quiz was a hit again.
Two days in Perth with our partner Ever Nimble, on security operations and cyber resilience.
Sponsors of the AUSCERT Cyber Security Conference on the Gold Coast.
Sponsors of the Gartner Security & Risk Management Summit in March.
Sponsors of the Cyber Security for Critical Assets Summit in Perth, February 2026.
Expert conversations with speakers and attendees at CyberCon Melbourne 2025.
Uncover hidden threats across IT, cloud, and industrial networks.
Give your security operations a trusted foundation: complete, AI-ready network evidence that analysts and agents can rely on. ThreatDefence NDR sees across your monitored networks, from east-west movement between internal systems to encrypted sessions and ICS/OT environments.
Hundreds of protocols are analyzed in depth and turned into structured records. Each record is enriched and linked to the session, asset, identity, and threat intelligence behind it, so evidence stays connected in one place instead of fragmented across separate tools.
East-west and north-south traffic, encrypted sessions, cloud networks, and OT segments, including devices that cannot run an agent.
Hundreds of protocols decoded into connection, DNS, TLS, HTTP, SMB, file, and industrial records, each linked to its session.
Records enriched with asset, identity, and threat intelligence, then joined with endpoint, email, and cloud evidence in one platform.
Agents query the same evidence analysts inspect, so every conclusion points back to the records behind it.
Review detections, affected hosts, traffic volumes, and monitored assets. Open a finding to examine its evidence and investigation status.
Compare activity with established patterns. Investigate unfamiliar connections, unusual hours, repeated outbound traffic, and unexpected transfers.
Use connection patterns and available TLS details to investigate suspicious encrypted activity without routinely decrypting traffic.
Discover recognized AI services reached from your network and compare observed activity with your organization’s approval register.
Review observed industrial assets, protocols, and communication paths. Investigate unexpected access and changes across monitored control networks.
Attackers can move through legitimate connections and use devices that endpoint tools do not cover. ThreatDefence NDR analyzes traffic across monitored networks, uncovering suspicious activity and recording the evidence needed to investigate it.
Identify communicating devices and services, including contractor laptops, printers, cameras, IoT, and industrial equipment.
Detect suspicious outbound connections, lateral movement, unusual transfers, and changes in how systems communicate.
Examine the connections, protocol records, and available packet captures behind each finding.
Block malicious destinations or isolate affected hosts through connected security tools, under your response policies.
ThreatDefence sensors receive copied traffic from a SPAN port, network TAP, or supported cloud mirror. They sit outside the forwarding path, so monitored traffic does not depend on the sensor remaining available.
East-west and north-south traffic, including devices that cannot run an endpoint agent.
A copy of the traffic reaches the sensor. The sensor sits outside the forwarding path.
Creates structured session records and applies signatures, behavioral analytics, and machine learning.
Findings join endpoint, identity, cloud, and threat intelligence data. Approved actions run through connected tools.
Monitor relevant connections at network cores, server segments, branch sites, cloud networks, and industrial boundaries.
Decode supported protocols, create structured session records, and apply signatures, behavioral analytics, and machine learning.
Bring network evidence into the platform alongside endpoint, identity, cloud, and threat intelligence data.
Coordinate approved response through connected firewalls, endpoint security, and other supported controls.
Sensor placement determines which traffic is visible. Our team helps identify the monitoring points needed for your systems and use cases.
An investigation may begin long after the first suspicious connection. ThreatDefence retains network records so analysts can examine earlier activity, identify related systems, and establish how a threat developed.
Connection records show which systems communicated, when, over which services, and how much data moved. Supported protocol records add detail, while configured packet capture supports deeper analysis.
Connect sessions, protocol events, and detections to follow the sequence of activity.
Extract and fingerprint files from supported, inspectable traffic and link findings to the hosts involved.
Revisit retained evidence when new intelligence identifies a suspicious destination, file, or system.
Forward metadata and detections to your SIEM or data lake, and export investigation records for further analysis.
Metadata retention and packet-capture settings are configured around your investigation needs and storage requirements.
A compromised system may use familiar protocols and permitted connections. Behavioral analysis helps reveal activity that differs from the host’s history or the surrounding environment.
ThreatDefence combines these changes with signatures and threat intelligence, giving analysts the signals behind a finding.
Investigate repeated connections, unusual destinations, and patterns associated with attacker communications.
Identify new remote-service relationships, unexpected administrative access, and movement between internal systems.
Examine changes in outbound volume, destinations, and the timing of data movement.
Find internal scanning, unexpected service use, and patterns that may indicate hidden communication channels.
ThreatDefence NDR feeds directly into the AI SOC platform. Network sessions, detections, and discovered assets connect with endpoint, identity, email, and cloud activity, helping agents and analysts assess the wider incident.
Connect suspicious traffic with affected devices, available user context, related alerts, and earlier cases.
Keep network evidence, timelines, AI assessments, analyst decisions, and response progress together.
Block destinations, isolate endpoints, or revoke sessions through connected tools, with permissions and approvals enforced by the platform.
Use network evidence in threat hunts, detection proposals, incident reports, and customer reporting.
Explore the AI SOC Platform
AI agents review NDR detections and investigate the activity behind them. They retrieve related sessions, compare behavior with established patterns, check threat intelligence, and query connected endpoint and identity tools.
Analysts receive a case with an assessment, supporting evidence, unresolved questions, and recommended actions.
For example: A finance workstation begins making regular connections to a suspicious destination, then contacts 14 internal hosts over SMB. Agents examine its traffic history, investigate the destination, and gather related endpoint and identity evidence.
The analyst reviews the findings and approves host isolation and destination blocking. The case records the decision, execution results, and follow-up work.
Agents gather and assess evidence across connected sources, reducing manual investigation work.
Inspect the verdict, confidence, supporting signals, and missing context behind each conclusion.
Prepare containment actions for approval or execute them within explicitly authorized limits.
Keep queries, findings, analyst decisions, and response outcomes together for review and reporting.
Network detections become more useful when the surrounding evidence is already assembled. AI agents retrieve related sessions, compare activity with its history, enrich destinations, and query connected tools.
Analysts receive a case explaining the findings, supporting evidence, unresolved questions, and recommended actions.
Connect a network address to available asset, endpoint, and identity records to understand which system is involved and why it matters.
Follow related connections to identify other hosts, destinations, and activity that need investigation.
Recommend targeted actions, such as blocking a destination or isolating an endpoint, with the required approvals.
Analysts review findings and direct further work. The platform enforces response permissions and records the outcome of each action.
FIN-WS-07 connects to 203.0.113.27 every 60 s, regular to within 2 s, over 6 hours.
Admin share access to 14 internal hosts, the first SMB activity from this host in 90 days.
update.dll, the file carved from the session, found on the host by the endpoint agent.
Block 203.0.113.27 at the firewall and isolate FIN-WS-07 through EDR, each awaiting approval.
Explore AI Alert Triage
Encryption protects application content, but connections still provide useful evidence. ThreatDefence analyzes observable destinations, timing, volumes, and handshake details to support investigation.
Repeated intervals, unusual destinations, and changes in data movement.
Observable protocol versions, negotiation details, and server names where exposed.
Supporting indicators assessed alongside other evidence.
DNS, endpoint, identity, and application activity that helps explain the connection.
Available detail depends on the protocol and encryption in use. The platform combines network observations with other sources to build context.
Case TD-4487, with the session records and packet capture attached.
Identify recognized AI services reached from monitored networks. Review source hosts, connection frequency, and traffic volumes alongside your organization’s AI service register.
Surface services in use without a recorded approval decision.
Compare observed connections with services marked approved, restricted, or blocked.
Connect policy exceptions to the relevant host and available user context.
Bring network observations into reviews alongside service policies, endpoint records, and application controls.
Network metadata reveals connection activity. Visibility into prompt or upload contents requires an appropriate application, endpoint, or inspection control.
chat.openai.com
app.writesonic.com
api.deepseek.com
app.poe.com
claude.ai
character.ai
Approved services, with connections and volume observed.
Observed on the network, waiting for an approval decision.
In use with no approval decision recorded.
Connections to a blocked service are raised for investigation.
Monitor OT communications without installing software on controllers or actively scanning sensitive equipment. Passive sensors help identify observed assets, establish communication patterns, and investigate activity across industrial zones.
Supported protocols include Modbus/TCP, DNP3, OPC UA, EtherNet/IP, and S7comm.
Identify observed controllers, HMIs, engineering workstations, historians, and other communicating systems.
Examine connections within control networks and across IT, OT, and remote-access boundaries.
Review new sources, unexpected engineering access, and supported command activity outside agreed operating patterns.
Guide response using asset criticality, production requirements, and the approvals appropriate to each environment.
The ThreatDefence Platform is operational technology cybersecurity technology offering visibility into your industrial control system assets and communications. Utilizing behavior-based analytics, it accurately identifies threats, pinpoints vulnerabilities and prioritizes them for action, and equips security teams with automated analysis and response strategies, streamlining the process of threat investigation and mitigation.
Search retained network evidence for activity that existing detections have not flagged. Investigate rare destinations, repeated outbound connections, unauthorized remote access, and unexpected movement between systems.
AI hunting skills help query the evidence and investigate matches. Analysts assess the results, open cases where needed, and turn validated attacker behavior into proposed detections.
Explore AI Threat Hunting
Deploy physical and virtual sensors across data centers, branches, cloud networks, and industrial sites. Findings reach the same platform, giving your team a shared view across monitored environments.
ThreatDefence recommends sensor placement and sizing based on traffic volumes, network layout, protocol mix, and capture requirements. The platform supports cloud or on-premises deployment.
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
Δ
Network detection and response analyzes traffic to identify suspicious activity and support investigation. ThreatDefence combines network evidence, signatures, behavioral analytics, AI investigation, and SOC response across monitored IT, cloud, and industrial environments.
EDR provides detailed activity from endpoints where an agent is installed. NDR adds evidence from monitored communications, including unmanaged devices and systems that cannot run an agent. Together, they help connect activity on a host with its behavior across the network.
A firewall primarily controls permitted traffic. NDR analyzes observed connections for signs of compromise and retains evidence for investigation. It can identify suspicious activity within allowed traffic and across internal segments, with containment coordinated through connected controls.
No. The passive sensor receives copied traffic from a SPAN port, TAP, or supported cloud mirror. It operates outside the forwarding path, so a sensor outage does not interrupt the original traffic.
No. The sensor observes network traffic without software on each device. Endpoint agents can add context and containment capabilities where available.
Yes. Connection patterns and observable handshake information remain useful without decrypting content. Visibility varies: TLS 1.3 encrypts certificate details, and Encrypted Client Hello can hide the requested server name. Endpoint and application records can provide additional context.
Not through passive observation alone. File extraction requires supported traffic whose content is visible to the analysis system. Encrypted connections can still provide metadata for investigation.
AI agents gather linked network records, add threat intelligence, and query connected systems for context. Analysts review findings and coordinate response under your procedures. Actions require approval or run within explicitly authorized limits.
The platform coordinates actions through connected security tools, such as blocking a destination at a firewall or isolating an endpoint through EDR. Available actions depend on integrations, permissions, and operating mode.
Retention is configured to suit your requirements. Session metadata and packet captures have different storage needs, so capture scope and retention periods are agreed during deployment.
Yes, where supported traffic mirroring supplies relevant traffic to a virtual sensor. Cloud and on-premises findings can be investigated through the same platform.
Yes. Network metadata and detections can be forwarded to your SIEM and other connected tools. ThreatDefence NDR works alongside your existing security stack.