AI agents investigate every alert, add context, and prepare cases for response, on a full-stack SecOps platform that captures and correlates all your security data.
Cloud-based SIEM platform providing visibility across all your data sources
Every alert investigated, with a verdict and the evidence behind it
Manage your external footprint, publicly available data, and Dark Web leaks
Log management and threat detection across any of your log sources
Get ultimate assurance that your environment is free from threat actors
Fully featured distrubuted NDR for on-premises and public cloud environments
A SecOps platform purpose-built for industrial and OT environments
Integrated endpoint agent providing deep visibility, response and forensics
Deploy honeypots and honeytokens and stay ahead of threat actors
24x7 security operations from our Australian SOC. AI investigates every alert, and experienced analysts validate findings and contain threats around the clock.
24x7 managed detection and response across endpoint, network, cloud, identity, and log sources
AI investigations and 24x7 MDR on the Microsoft Sentinel you already own
Eyes-on-glass SOC and continuous threat hunting
Expert hunters and AI agents find attacker activity your alerts missed
Quickly recover from cyber attacks and breaches
ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24x7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Monitoring, evidence and a 24x7 SOC in one platform
Compliance monitoring, evidence and board reporting
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
Articles on security operations, AI and compliance
Events, awards and company news
Read what our customers say about us
Solution briefs and datasheets
How we keep your data secure
Technical support and knowledge base
Guides, case studies, and advisories in one place
How AI agents investigate alerts and run security operations
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to incident response and digital forensics
Where SOAR playbooks fit and where AI agents take over
Free ebook: modern security operations with Microsoft Sentinel
How the framework is structured and what changes from the Essential Eight
November 13, 2026
November 10, 2026
November 6, 2026
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Embed security operations, threat intelligence and exposure data in your product
Sovereign SOC for Australian MSPs and MSSPs, with onshore analysts and client data
Set the rules for closing alerts automatically, with evidence checks and review
How MSPs deliver branded security monitoring with a SOC partner
ThreatDefence was an official partner of the Cyber Resilience Summit NSW, 29 October 2026 at Hilton Sydney.
Our team was back at BSides Canberra, and our cyber quiz was a hit again.
Two days in Perth with our partner Ever Nimble, on security operations and cyber resilience.
Sponsors of the AUSCERT Cyber Security Conference on the Gold Coast.
Sponsors of the Gartner Security & Risk Management Summit in March.
Sponsors of the Cyber Security for Critical Assets Summit in Perth, February 2026.
Expert conversations with speakers and attendees at CyberCon Melbourne 2025.
An AI SOC analyst investigates security alerts by querying connected tools, testing possible explanations, and preparing a verdict with supporting evidence. It handles much of the initial investigation so your analysts can focus on the findings and decisions that need their expertise.Its value depends on the work it can complete in your environment. The useful test is whether analysts receive a case they can review and act on, with less research left to do.
An AI SOC analyst performs tasks normally associated with first-line alert investigation: reading the source event, looking up affected entities, examining related activity, and deciding whether the evidence supports escalation or closure.
Much of Tier 1 work happens between the alert and that decision. A suspicious sign-in may require an analyst to check the device, authentication method, previous activity, and what the account did afterward. The alert itself rarely contains everything needed to explain it.
An AI Tier 1 analyst can retrieve that evidence and follow up on what it finds. A new sign-in might lead to a mailbox audit search; an inbox rule might lead to checks for other affected accounts. The investigation develops from the results rather than ending with a rewritten alert description.
The output should explain what happened, what remains uncertain, and what needs to happen next. Depending on the implementation and its permissions, the agent may also create a case, route an escalation, or prepare response actions.
A copilot usually helps with a task the analyst directs, such as explaining a command or writing a query. An AI SOC analyst is expected to carry a defined investigation forward without someone prompting every step.
Playbooks follow configured steps and branches. An investigative agent can select further checks as evidence emerges, while still using playbooks for predictable tasks such as enrichment, ticket updates, and approved response sequences.
Products can combine these approaches, so the label alone tells you little. During a demonstration, ask the system to investigate beyond the supplied alert. Check whether it queries live evidence, follows an unexpected result, and identifies what it could not establish.
AI can take on substantial investigation work without taking over every decision. The division depends on the alert class, available evidence, and authority granted to the agent.
These are responsibilities to evaluate, not guaranteed performance. Human conclusions can also be incomplete or incorrect, so compare both against the evidence rather than assuming agreement establishes the truth.
An alert connection and an investigation connection are different things. Receiving a detection from an endpoint tool does not establish that the agent can retrieve its process tree, file activity, or historical records.
Check three kinds of access:
Can it query the underlying events, relevant history, and related systems, or only read the alert payload?
Can it identify critical assets, account roles, approved activity, and relevant earlier cases?
Can it only investigate, prepare an action for approval, or execute a specifically authorized response?
Validate access using actual searches. Licensing, retention, audit settings, and API permissions can limit what a connected tool returns. A failed query, an unavailable source, and a completed search with no matches are different findings.
Access should remain scoped to the investigation and customer. The platform must enforce those boundaries independently of the model, including when an alert contains attacker-controlled text.
An unsigned program reading LSASS memory on a workstation could be a security tool doing its job or an attempt to collect credentials. The agent needs to establish what the program is, how it started, and what the account behind it did next.
It can start with the endpoint event, trace the process back to how it arrived, and check outbound connections and sign-ins that followed. If the evidence suggests credential theft, it should establish which accounts and systems are exposed and prepare the appropriate containment.
In one example run, the agent queried 6 sources in 7 steps and reached a verdict in 41 seconds, at about two cents per investigation. These figures describe one run, not average speed or cost across other alerts.
The conclusion needs to rest on the combined evidence. An unsigned binary alone does not prove credential theft, and a hash with no threat intelligence match does not rule it out. Findings about lateral movement and account misuse also need the relevant telemetry; they should not be inferred from a connector name.
Include the analyst’s review in the time measurement. A fast agent run saves little if the reviewer has to reconstruct the investigation before deciding what to do.
A verdict should let another analyst understand and verify the conclusion without starting over. Look for:
What happened, when, and which accounts or systems were affected.
Whether the activity is benign, malicious, suspicious, or unresolved, with facts separated from inference.
Relevant source records linked to the findings they support.
What was searched, over which period, and what the searches returned.
Legitimate explanations tested, including evidence that contradicts the proposed verdict.
Missing sources, failed queries, and unanswered questions.
Recommended investigation or response, with approval requirements shown.
A confidence score is an input to review, not proof of correctness. Unless its meaning has been validated, a score of 93% should not be read as a measured 93% probability that the verdict is right.
The explanation matters too. More queries and longer reports do not necessarily mean a stronger investigation. Check whether the agent answered the questions needed to support its conclusion.
An autonomous SOC analyst can investigate independently while still requiring permission to close a case or change a system. Define those authorities separately.
Bring a person into the investigation when:
The assessment cannot reconcile important findings.
A missing source or failed search prevents a supported conclusion.
An owner must verify a change or explain account activity.
The workflow has not been validated for the situation it encounters.
The proposed change affects systems or services outside the agent’s execution authority.
The handover should identify the unresolved question and the work already completed. An escalation that only says “human review required” leaves the analyst to rediscover the problem.
For response, show the target, intended action, expected impact, and available recovery options before approval. An accurate verdict does not establish that every suggested containment action is appropriate.
Run it on representative investigations from your environment, compare its findings with independently reviewed evidence, and measure the human effort left afterward. A polished demonstration or one successful alert class cannot establish performance across the queue.
Include frequent alerts, confirmed attacks, suspicious-looking legitimate activity, and cases with missing evidence. Use native and custom detections where relevant, across the source combinations the agent is expected to investigate. Include attacker-written instructions in evidence to check whether they can redirect the investigation or trigger an unauthorized action.
Historical cases are useful only if the test reflects what was available at the time. Withhold later incident notes, final outcomes, and other information that would reveal the answer.
Start in recommend-only mode. Analysts retain closure and response decisions while agents investigate the selected alerts.
Count the whole workload: completed investigations, skipped alerts, failed runs, and incomplete results. Reporting accuracy only on cases the agent chose to finish can hide important coverage problems.
Where practical, record the human assessment before revealing the AI verdict. Give both comparable source access and search windows so the comparison tests investigation quality rather than unequal information.
Review disagreements against the evidence. The original analyst label may need correction, and some cases should remain inconclusive. Distinguish missing data from an incorrect interpretation or an unsuitable investigation method.
Track incorrect benign verdicts, missed escalations, evidence completeness, unnecessary referrals, and unfinished runs by alert class. Report the number and mix of cases behind any agreement rate.
Measure analyst review, additional investigation, corrections, and approvals alongside agent runtime. Keep model or execution cost separate from the total cost of operating the workflow. This shows whether the system saves work rather than simply producing results faster.
Agreement alone is insufficient: the consequences of incorrectly dismissing an attack differ from those of referring a benign alert.
Keep original trial results separate from retests after fixes. Validate changes on additional cases beyond those used to refine the workflow, and rerun relevant tests after changes to models, skills, tools, or permissions.
Feedback needs an implementation path. An analyst correction might require a new data source, a repaired field mapping, updated context, or revised investigation instructions. A comment in a case should not be assumed to change future behavior automatically.
AI changes where an analyst begins. Instead of collecting every record manually, they may start by testing an assembled assessment: does the evidence support the verdict, what has been overlooked, and what should happen next?
That work still requires technical depth. Analysts need to inspect raw events, recognize unsupported assumptions, and investigate beyond the agent’s findings. Keep hands-on investigation and incident practice part of development, especially for newer team members who are learning how attacks appear in telemetry.
Use the capacity gained for complex cases, threat hunting, and detection improvement. Staffing decisions should reflect those responsibilities and actual review demand, rather than equating automated alert handling with an entire role removed.
AI can investigate outside business hours, but a completed assessment does not mean the threat has been contained. Urgent findings still need a reachable decision-maker unless the required action is explicitly authorized to run automatically.
Define who receives escalations, who handles integration failures, and how unresolved cases pass between shifts. Measure the wait from agent completion to human review and from decision to action. Those intervals show whether faster investigation is producing faster protection.
ThreatDefence AI triage investigates every alert from connected tools through their APIs, correlates activity across endpoint, identity, network, and cloud, and adds asset, identity, and threat intelligence context. Each verdict includes confidence, severity, the MITRE ATT&CK technique, evidence, queries, a summary, and recommended next actions.
Analysts in the ThreatDefence 24x7 SOC review escalations and approve actions, and low-confidence cases always go to a person. The AI SOC platform runs the same AI analyst across every client tenant for partners using AI SOC for MSPs.
Explore AI Alert Triage
Watch it investigate an alert, show its evidence and queries, and hold response actions for analyst approval.
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
Δ
An AI SOC analyst investigates security alerts using connected tools, gathers related evidence, tests explanations, and prepares a verdict with recommended next steps. Some can also route cases or prepare response actions. Execution depends on separate permissions and approval rules.
AI can automate much of the evidence gathering, analysis, and documentation involved in Tier 1 work. People still resolve uncertainty, assess business impact, communicate findings, and oversee response. Staffing needs depend on the work automated, the review effort retained, and the service the team must deliver.
There is no accuracy figure that applies to every AI SOC analyst or environment. Results depend on the alert class, available evidence, investigation method, and evaluation design. Test incorrect benign verdicts, missed escalations, incomplete runs, and supporting evidence alongside analyst agreement.
It needs scoped access to source records, relevant history, and the asset, identity, and business context required for its investigations. Confirm what each integration can actually retrieve. Permission to investigate does not automatically grant permission to close alerts or execute response actions.
Run it in recommend-only mode on representative live alerts and historical cases with verified outcomes. Record independent assessments, review disagreements against evidence, and include failed or incomplete runs. Measure analyst review and correction time as well as agent speed and investigation quality.
Analysts still need to interpret security telemetry, investigate related activity, assess evidence, and communicate clearly. They also need to recognize gaps in AI-generated findings and decide when to challenge a verdict or expand the investigation. Strong fundamentals make review useful rather than a confirmation exercise.
AI SOC Agents
Autonomous SOC
What Is an Agentic SOC