ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24×7 managed detection and response across endpoint, network, cloud, identity, and log sources
Eyes-on-glass SOC and continuous threat hunting
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Get ultimate assurance that your environment is free from threat actors
Quickly recover from cyber attacks and breaches
24×7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Cloud-based SIEM platform providing visibility across all your data sources
Manage your external footprint, publicly available data, and Dark Web leaks
AI triage, investigation and response on the tools you already run
Fully featured distrubuted NDR for on-premises and public cloud environments
Deploy honeypots and honeytokens and stay ahead of threat actors
Every alert investigated, with a verdict and the evidence behind it
Integrated endpoint agent providing deep visibility, response and forensics
Log management and threat detection across any of your log sources
A SecOps platform purpose-built for industrial and OT environments
ThreatDefence puts security and compliance at the heart of our service, keeping your data protected at all times.
See how we keep your data secure.
Read what our customers say about us
Solution briefs and datasheets
Technical support and knowledge base
What to check in your Microsoft 365 tenant
Remote code execution flaws that need patching now
Essential Eight monitoring, reporting, and evidence for ongoing compliance
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to Incident Response and Digital Forensics
Read how cyber range helps to train cyber defenders
How AI agents investigate alerts and run security operations
How AI SOC platforms work, from integrations to autonomy
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Where SOAR playbooks fit, where AI agents take over, and how the two work together.
AI SOC hyperautomation transforms cybersecurity ops by autonomously detecting, analyzing, and remediating threats.
Honored to Support the Launch of the University of Technology Sydney Cybersecurity Precinct!
ThreatDefence Cyber had the privilege of meeting with Honeywell Dubai’s Digital City leadership to explore synergies in OT/SCADA and…
Read More
Equinox to support companies with ready to use, end-to-end SecOps infrastructure, including a full stack platform able to capture and…
ThreatDefence had an amazing time at AISA CyberCon 2024, connecting with industry leaders and advancing cyber security conversations.
An AI SOC platform connects AI agents to your existing security tools to triage alerts, investigate threats, and support response within approved limits. It brings the evidence, queries, verdicts, and actions together in a shared case record for analyst review.This guide explains what to look for when choosing a platform, including core capabilities, architecture, integrations, operating controls, and deployment options.
An AI SOC platform investigates alerts from connected security tools. When an alert arrives, an agent identifies the questions to answer, queries relevant sources, tests possible explanations, and produces a verdict supported by evidence. Analysts start with an investigated case, including unresolved questions and recommended next steps. The same capabilities support response, threat hunting, and detection engineering.
The platform works across the security tools a team already uses, bringing their alerts, telemetry, and response capabilities into a shared investigation workflow.
An autonomous SOC uses AI agents to investigate alerts and execute approved actions with limited human intervention. Autonomy varies by workflow: an agent may investigate independently but still need approval to contain an endpoint. People define its permissions, review its performance, and remain accountable for material decisions.
A platform can use different levels of autonomy for each task and customer. Greater autonomy should follow demonstrated reliability and explicit approval, with people remaining accountable for the outcome.
Rewrites the alert in plain language without gathering new evidence.
Queries connected security tools, correlates findings, and tests benign and malicious explanations.
Produces an evidence-backed verdict, states uncertainty, and recommends ordered next steps.
Prepares response actions and holds execution until an authorized person approves.
Executes explicitly authorized actions when defined conditions are met, then records and reports the outcome.
An AI SOC platform connects your security tools through a security context layer, runs AI agents within defined permissions, and brings their findings into an analyst workbench. Human oversight and audit records provide control and traceability across the workflow.
Investigation quality depends on how these components work together. An agent needs relevant data, reliable queries, and environment context to reach a supported conclusion. If it can only read the original alert, even a convincing explanation adds little to the investigation.
An AI SOC platform needs to connect across the organization’s security and business environment: SIEM, EDR, XDR, NDR, firewalls, identity, email, cloud, SaaS, vulnerability management, threat intelligence, and service management. Broad, vendor-agnostic integration lets agents follow evidence wherever an investigation leads, using the tools the organization already operates.
Those connections need depth as well as breadth. Receiving an alert gives an agent a starting point. Completing the investigation may require querying historical events, retrieving artifacts, checking account permissions, examining network activity, and confirming the outcome of a response action.
The platform collects alerts and events from connected tools, preserving timestamps, source details, severity, and references to the original records. Normalization makes information from different products usable within the same investigation.
Agents need to query connected systems as findings emerge. A suspicious sign-in may lead to checks of authentication changes, mailbox activity, endpoint processes, and network connections. Query results should retain their source and be recorded in the case.
The security context layer connects users, accounts, devices, addresses, and cloud resources across tools. It adds asset importance, identity privileges, threat intelligence, and relevant history so agents can assess activity in the context of the organization.
Integrations should support approved response actions, including endpoint isolation, session revocation, message quarantine, and indicator blocking. The platform enforces permissions and approval requirements, checks execution results, and records what changed.
A platform needs maintained connectors for widely used products and a way to connect custom applications, legacy systems, and specialist technologies. APIs, webhooks, log ingestion, and custom connectors extend coverage as the environment changes.
Connector health, credential expiry, API limits, and query failures need continuous monitoring. Agents must distinguish between finding no suspicious activity and being unable to retrieve the evidence. Missing data should remain visible in the assessment and trigger escalation where required.
AI agents use connected tools to test hypotheses, uncover relationships, and pursue findings across systems. These connections enable capabilities such as:
Each connection should use scoped credentials, enforce tenant boundaries, and record queries and actions for review. The available operations depend on the product’s APIs and permissions, while the platform provides a consistent way for agents and analysts to use them throughout an investigation.
An alert becomes more meaningful when the platform understands the environment behind it: who the user is, what the device does, which privileges are involved, and whether the activity fits established behavior. The security context layer brings that information together so agents can investigate with a consistent view across connected tools.
It normalizes data and links related entities, allowing an account, endpoint, IP address, and cloud resource to be followed through the same investigation. Asset importance, identity permissions, and threat intelligence help agents distinguish routine activity from a credible threat and assess its potential impact.
Per-tenant memory preserves relevant context from previous investigations, including validated findings, known administrative activity, and customer-specific procedures. That context helps agents avoid repeating work while remaining subject to review and updates as the environment changes. Tenant isolation keeps each customer’s data and investigation memory within its authorized boundary.
An AI SOC platform combines triage, investigation, response, hunting, detection engineering, and case management using shared evidence and security context.
AI agents check for duplicates, examine relevant activity, and assign an evidence-backed verdict and priority, extending investigation coverage to lower-severity alerts that might otherwise receive limited attention.
Agents query connected tools, build timelines, and test benign and malicious explanations. Each finding guides the next query, with evidence gaps and unresolved questions visible to analysts.
The platform prepares and executes response actions with human approval or within authorized limits. Controls govern affected systems, execution scope, and recovery, with outcomes verified and recorded.
Agents run reusable hunting skills across historical telemetry and follow suspicious findings beyond the original hypothesis. Confirmed threats become cases, and repeatable patterns inform new detections.
AI uses investigation findings to propose new detections and improve existing rules. Changes are supported by evidence, version-controlled, tested, and approved before deployment.
The platform keeps evidence, queries, timelines, verdicts, actions, and approvals in one case record, synchronizes ticket updates, and supplies customer reports, quality metrics, and audit exports.
These capabilities form a continuous improvement loop: investigations improve detections, hunts reveal coverage gaps, and validated findings strengthen future investigations.
AI agents carry out investigations, choosing which tools to query and what to check next as evidence emerges. Skills give them established methods to draw on: how to investigate a suspicious sign-in, search for endpoint persistence, or assess possible data exfiltration.
Together, agents and skills combine adaptive investigation with consistent SOC tradecraft.
Agents handle defined responsibilities such as triage, investigation, response, hunting, and detection engineering. Each has access to the tools and permissions needed for its role. They share evidence through the case record, allowing one agent’s findings to guide another’s work.
A skill packages the objective, investigation guidance, relevant queries, evidence requirements, and escalation criteria for a task. For example, a Microsoft 365 investigation skill can guide checks of sign-in history, authentication changes, application consents, and mailbox activity. The agent follows that method while adapting its queries to the findings.
The skills library grows as the SOC encounters new threats, technologies, and investigation patterns. Analysts can turn a successful hunt into a reusable skill, refine an existing method, or add guidance for a customer’s environment. Testing, version control, and review keep those changes traceable before they are released.
The same skills should be available to automated agents and analysts using connected AI assistants. This lets analysts direct investigations using established methods, inspect the evidence, and extend the work when a case needs deeper analysis. Permissions and logging apply whichever way the skill is run.
Each run records the skill version, tools called, query parameters, returned evidence, conclusions, and actions. Analysts can inspect and rerun queries to validate the findings. Customers and partners should retain ownership of the skills they develop, with export options that preserve their work.
For more detail on agent behavior and skill development, see AI SOC agents.
An AI SOC platform can be run by your team, operated as a managed service, or shared with a provider. Each model defines who manages investigations, approves response actions, and provides analyst coverage.
Responsibilities for escalation, containment approval, communications, and detection changes should be agreed before service begins, including who acts when the primary contact is unavailable.
An AI SOC platform accesses sensitive telemetry and may hold permissions to act across security tools. Its controls need to protect customer data, constrain agent behavior, and keep investigations traceable. Those controls must operate across integrations, agent execution, model requests, and analyst access.
Customer data, agent memory, and investigation records should follow defined retention and deletion policies. Changes to models, tools, skills, and permissions also need testing and review because they can change how agents behave.
What is an agentic SOC covers these guardrails and data handling controls in more detail.
MSPs and MSSPs need an AI SOC platform that supports many client environments through one operational model. It must accommodate different tools, procedures, and automation settings while preserving tenant boundaries, supporting the provider’s brand, and keeping delivery efficient as the service grows.
Each client’s data, credentials, agent memory, cases, and access permissions remain isolated. Tenant boundaries apply to every query, agent task, and response action.
Analysts manage cases across clients from one queue, with customer context, priorities, procedures, and escalation paths attached to each investigation.
Investigation and response permissions are configurable by client, workflow, and action type. One client can authorize specific automated actions while another requires analyst approval.
Authorized analysts can hunt across selected client environments within their permissions. Findings and supporting evidence are recorded in the appropriate client tenant.
Portals, reports, notifications, and exports support the provider’s branding. Shared case access enables partner and provider analysts to collaborate in a co-managed service.
Partners retain ownership of the skills and detection content they develop. Client data, case histories, and partner-created content remain exportable in usable formats, subject to access permissions.
For more detail on the partner model, see AI SOC for MSSPs.
Adopting an AI SOC platform does not require an immediate SIEM replacement. Agents can investigate alerts from your existing SIEM through supported integrations, allowing you to introduce AI capabilities while assessing whether consolidation would improve cost, coverage, or operations.
If you decide to migrate, move in controlled stages and maintain monitoring throughout the transition.
ThreatDefence combines an AI SOC platform with a 24x7 SOC, delivered as a managed service, co-managed with your team, or white-labeled for partners. It connects to the tools you already run, including Microsoft Sentinel, Splunk, Microsoft Defender, and CrowdStrike, runs agents in recommend-only, approval-required, or autonomous modes within approved limits, and keeps each customer’s data and AI processing in Australia or the United States.
Faster investigations. Clear evidence. Coordinated response.
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
Δ
An AI SOC platform uses AI agents to triage alerts, investigate threats, and coordinate response across connected security tools. Evidence, queries, verdicts, and actions stay together in a case record for analyst review.
Agents receive alerts, query relevant tools, and test possible explanations. Findings guide subsequent queries until the agent reaches a supported conclusion or escalates to an analyst. Response actions follow configured permissions and approval requirements.
A capable platform combines broad integrations, adaptive investigation, evidence-backed verdicts, controlled response, and an effective analyst workbench. It also needs reliable tenant isolation, quality reporting, and an operating model that fits the team using it.
SOAR primarily executes predefined workflows and conditional branches. AI agents adapt investigations as evidence emerges, selecting follow-up queries and testing explanations. Both can work together: agents investigate, while playbooks execute established procedures.
It does not have to. The platform can investigate alerts from your existing SIEM through supported integrations. SIEM consolidation remains a separate decision based on cost, coverage, retention, and operational requirements.
Agents take on evidence gathering and routine investigation work. Analysts focus on complex incidents, hunting, detection improvements, and response decisions. People define permissions, review quality, and remain accountable for outcomes.
Connections typically span SIEM, EDR/XDR, NDR, firewalls, identity, email, cloud, SaaS, vulnerability management, threat intelligence, and ticketing. Integration depth determines whether agents can receive alerts, query supporting evidence, and execute approved actions.
Yes, for explicitly authorized actions under defined conditions. Controls specify eligible targets, execution limits, approval requirements, and recovery procedures. Broader autonomy should follow testing, demonstrated reliability, and approval.
Analysts check conclusions against source evidence and query results. Ongoing quality reviews track incorrect closures, missed escalations, evidence completeness, and overrides by alert class. Confidence scores and analyst agreement support review but do not establish correctness on their own.
Skills package reusable investigation and hunting methods, including objectives, guidance, queries, evidence requirements, and escalation criteria. Analysts maintain and extend the library as threats, tools, and environments change.
Controls include isolated execution, least-privilege access, brokered credentials, tenant isolation, and protected audit records. Policies enforced outside the model constrain tool use, while testing checks for prompt injection, unintended actions, and data exposure.
Yes, when it is built for multi-tenancy. Providers need tenant isolation, one operations queue across clients, per-client autonomy settings, cross-tenant hunting within permissions, white-label delivery, and ownership of the skills and detection content they build.
AI SOC Platform Guide: your path to AI-enabled security operations
The ThreatDefence AI SOC platform: triage, investigation, and response
What is an agentic SOC? How AI-driven security operations work