AI agents investigate every alert, add context, and prepare cases for response, on a full-stack SecOps platform that captures and correlates all your security data.
Cloud-based SIEM platform providing visibility across all your data sources
Every alert investigated, with a verdict and the evidence behind it
Manage your external footprint, publicly available data, and Dark Web leaks
Log management and threat detection across any of your log sources
Get ultimate assurance that your environment is free from threat actors
Fully featured distrubuted NDR for on-premises and public cloud environments
A SecOps platform purpose-built for industrial and OT environments
Integrated endpoint agent providing deep visibility, response and forensics
Deploy honeypots and honeytokens and stay ahead of threat actors
24x7 security operations from our Australian SOC. AI investigates every alert, and experienced analysts validate findings and contain threats around the clock.
24x7 managed detection and response across endpoint, network, cloud, identity, and log sources
AI investigations and 24x7 MDR on the Microsoft Sentinel you already own
Eyes-on-glass SOC and continuous threat hunting
Expert hunters and AI agents find attacker activity your alerts missed
Quickly recover from cyber attacks and breaches
ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24x7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Monitoring, evidence and a 24x7 SOC in one platform
Compliance monitoring, evidence and board reporting
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
Articles on security operations, AI and compliance
Events, awards and company news
Read what our customers say about us
Solution briefs and datasheets
How we keep your data secure
Technical support and knowledge base
Guides, case studies, and advisories in one place
How AI agents investigate alerts and run security operations
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to incident response and digital forensics
Where SOAR playbooks fit and where AI agents take over
Free ebook: modern security operations with Microsoft Sentinel
How the framework is structured and what changes from the Essential Eight
November 10, 2026
November 6, 2026
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Embed security operations, threat intelligence and exposure data in your product
Sovereign SOC for Australian MSPs and MSSPs, with onshore analysts and client data
Set the rules for closing alerts automatically, with evidence checks and review
How MSPs deliver branded security monitoring with a SOC partner
ThreatDefence was an official partner of the Cyber Resilience Summit NSW, 29 October 2026 at Hilton Sydney.
Our team was back at BSides Canberra, and our cyber quiz was a hit again.
Two days in Perth with our partner Ever Nimble, on security operations and cyber resilience.
Sponsors of the AUSCERT Cyber Security Conference on the Gold Coast.
Sponsors of the Gartner Security & Risk Management Summit in March.
Sponsors of the Cyber Security for Critical Assets Summit in Perth, February 2026.
Expert conversations with speakers and attendees at CyberCon Melbourne 2025.
A VPN gateway, a firewall or a forgotten test portal is a common way in for an attacker, so ASD Essentials places internet-facing services and edge devices in priority phase 1.
These assets make up the Boundary services domain, which ASD defines as Assets at network boundaries that broker connectivity between environments of different trust levels, including internet-facing services and edge devices. VPN concentrators, web applications, API endpoints and remote access gateways are common examples alongside firewalls.
Assets at network boundaries that broker connectivity between environments of different trust levels, including internet-facing services and edge devices.
Boundary services shares priority phase 1 of the enterprise IT chapter with Identity services. ASD states that boundary systems are routinely exposed to adversary scanning and exploitation making them common targets for initial access. The domain brings the Essential Eight’s application and operating system patching strategies into broader vulnerability management, with risk-based treatment timeframes, secure configuration, traffic controls and evidence that remediation works.
are routinely exposed to adversary scanning and exploitation making them common targets for initial access.
The scope of Boundary services in ASD Essentials reaches past the perimeter firewall. It takes in internet-facing systems and the infrastructure that controls connections between trusted and less trusted environments, including the applications, gateways and network devices through which external access is possible.
ASD’s enterprise IT asset scoping guide, published October 15, 2026, identifies VPN concentrators, remote access solutions, web servers and applications, API endpoints, email gateways, firewalls and the routers and switches connecting the internet to internal networks.
Start with the services an external user or system can reach, then trace how each one connects to internal networks. An asset can be part of the boundary because of its network position or the access it provides, even when its product category does not suggest a security function.
ASD’s scoping questions give a practical way to classify these assets:
Can the system be reached from the internet without first connecting to an internal network?
Does the asset operate in a DMZ or provide a connection between environments with different trust levels?
Could compromise of the asset allow an attacker to move further into the organisation’s network?
Non-production environments are included. A development application, temporary test portal or forgotten web service can create an external entry point even when it holds no production data.
Asset discovery has to work from what is actually exposed, because a list of production systems leaves these services out. Comparing external discovery results with the maintained boundary inventory shows which services have been missed.
The same asset can sit in more than one ASD Essentials domain when it performs several security functions.
A remote access gateway used by administrators, for example, may be both a Boundary service and part of a Privileged environment. Its network exposure, configuration and vulnerabilities need attention, along with the permissions and security of the accounts using it.
VPNs, remote desktop gateways and web portals also depend on identity controls. The ASD Essentials Identity services guide covers authentication, credentials and access management.
ASD Essentials asks organisations to set their own patching and remediation timeframes according to risk. No single deadline applies to every vulnerability. For Boundary services, internet exposure and the availability of working exploits are among the first things to weigh.
Vulnerability management covers identifying software and configuration weaknesses, prioritising treatment, applying updates or mitigations and verifying the results.
The scanning action calls for continuous, repeatable assessments. A vulnerability scanner that checks operating system patches but ignores insecure appliance settings provides only part of the coverage the action asks for.
The patching action states:
Apply security patches or updates within defined risk-based timeframes or automatically where operational impact is low.
Patching and remediation are related but separate activities. Installing an available update addresses the patching action. The remediation action goes further: vulnerabilities above defined risk thresholds are remediated or mitigated within defined timeframes, and the effectiveness of the treatment is verified.
A typical case is a gateway flaw for which the vendor has not yet released an update. Nothing can be installed, yet the remediation action still applies, and a mitigation such as disabling the affected feature is the treatment to record and verify.
The Essential Eight Maturity Model remains maintained alongside ASD Essentials and continues to specify fixed patching timeframes.
At Maturity Level One, patches for online services are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist, and online services are scanned for vulnerabilities at least daily.
within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist,
ASD Essentials takes a risk-based approach. The organisation defines each treatment timeframe from factors that reflect the affected asset and the consequences of exploitation.
Those factors include:
Whether the vulnerability is already being exploited or working exploits exist.
Whether the affected asset can be reached from the internet or other untrusted networks.
How important the system is to business operations and dependent services.
The consequences of compromise, alongside the operational impact of applying a patch or mitigation.
Protections that reduce exposure while the vulnerability remains unresolved.
A documented timeframe has to be met in practice. Patch records, missed deadlines, approved exceptions and verification results show whether it is.
ASD’s transition guidance states that Applicable ISM, regulatory and other mandatory timeframes continue to apply, and that treatment timeframes may differ between domains because their assets and risk contexts differ.
Applicable ISM, regulatory and other mandatory timeframes continue to apply,
may differ between domains because their assets and risk contexts differ.
Risk-based patching leaves existing mandatory deadlines in place. The organisation sets defensible timeframes for the assets in scope and continues to meet any obligations that apply to it.
For most organisations, internet-facing systems will justify some of the shortest treatment windows because they are directly exposed to external scanning and exploitation.
Unsupported appliances and legacy boundary systems need documented risk treatment when security updates are unavailable.
Legacy system management sits within Governance and culture. Boundary services deals with the exposure of the affected system and the security controls around it.
For an unsupported VPN appliance or gateway, the practical order of work is to identify the asset, document the vulnerability, assess its exposure, apply available compensating controls and track its replacement or decommissioning.
Restricting network access, removing unnecessary connectivity and increasing monitoring may reduce risk while the system stays in operation. Each measure needs to be assessed for its effect, because none of them removes the vulnerability.
The unresolved issue stays visible in vulnerability reporting and risk tracking until treatment is completed. Continuing to operate an unsupported device without a replacement or decommissioning path is not an effective long-term treatment.
Secure configuration management applies to boundary infrastructure, including firewalls, VPN appliances, load balancers, gateways and internet-facing web servers.
ASD calls for approved configuration baselines that disable or remove unnecessary services, insecure settings, and unsupported or weak communication protocols, across infrastructure, operating systems and applications.
disable or remove unnecessary services, insecure settings, and unsupported or weak communication protocols,
For boundary devices, a configuration review examines exposed management interfaces, enabled services, communication protocols, appliance accounts and settings that permit access between network zones.
Default and unused appliance accounts are disabled or removed. Administrative access is restricted to authorised, hardened management environments.
The configuration drift action asks for departures from approved settings to be detected through scheduled technical assessments and, where supported, automated monitoring. Review frequency follows system criticality and how often configurations change.
An approved firewall configuration is useful evidence of intent. Comparing it against the running configuration shows whether the intended controls are still in place. For example, a temporary rule added during an outage and never removed shows up only in that comparison. Each drift finding needs a recorded response and evidence of closure.
Vendor advisories also trigger work. Organisations review relevant advisories, assess exposure and respond within timeframes proportionate to the risk.
within timeframes proportionate to the risk.
For an exposed appliance, an advisory review settles whether the affected product is present, whether the vulnerable functionality is enabled, what treatment is available and whether there is evidence that calls for further investigation.
Network segmentation and content filtering control which connections and content may cross a boundary. Their effectiveness depends on the pathways actually permitted. The presence of firewall rules or a filtering product does not settle it.
The segmentation action states:
Isolate systems within network zones based on business criticality and trust level, and restrict and monitor inbound and outbound access to explicitly approved pathways and services.
Zones are drawn by business criticality and trust level. Connections between them are limited to approved services and operational requirements.
ASD’s fully effective indicators include deny-by-default rules between network segments, supported by technical assessment.
A firewall rule set showing a deny-by-default policy is a starting point. The assessment also needs to check whether exceptions allow only the intended traffic and whether the actual connectivity matches the approved network design.
Rule reviews record the owner, business justification and decision for each permitted pathway. A rule that nobody can justify is removed at that review and does not carry forward to the next one.
Content filtering adds inspection and blocking controls to Boundary services. The principle has no direct equivalent among the Essential Eight strategies.
Each of its actions applies in this domain.
Outbound content inspection detects unauthorised transfers of sensitive or high-value information. Coverage follows the applicable egress paths and the types of information that need protection.
The other actions ask organisations to:
Block outbound network connections to known malicious or untrusted destinations,
Inspect inbound content from external or untrusted sources to prevent delivery of malicious or unsafe content.
Unlike Identity services, Boundary services carries the outbound destination blocking and inbound content inspection actions, alongside outbound content inspection.
Effective blocking depends on coverage as well as the quality of the filtering decisions. A web proxy may inspect one outbound path while other connections leave through a different gateway.
Current threat intelligence informs decisions about malicious destinations. Destination lists need maintenance, and inbound filtering rules and signatures have to stay current.
Blocked content is logged and available for review. The records show which boundary control made the decision, what was blocked and whether follow-up investigation was necessary.
Existing Essential Eight controls give Boundary services a starting point, particularly in vulnerability management, MFA and secure administration.
ASD’s transition guide maps the Essential Eight strategies to relevant ASD Essentials principles and actions. Its maturity labels, which ASD does not define, are references for gap analysis. They do not produce an ASD Essentials effectiveness rating on their own.
Patching shows why existing implementation and ASD Essentials effectiveness are different questions.
An Essential Eight patching program may already produce scan results, deployment records and remediation histories. ASD Essentials also examines whether risk-based timeframes are defined, whether vulnerabilities above the organisation’s thresholds are treated consistently and whether treatment is verified.
Existing evidence can be reused where it is still current and supports the applicable action. Missing coverage, such as configuration weaknesses on edge devices or untracked compensating controls, still needs to be addressed.
Moving from the Essential Eight to ASD Essentials explains the broader transition mapping and evidence reuse approach.
The evidence to collect for Boundary services ties the inventory of exposed assets to the scanning, patching, configuration and filtering controls applied to them. An assessor looks for the intended control and for proof that it operates across the domain.
The collection methods are common practice rather than ASD requirements. The checks in the last column draw on ASD’s Indicators of Good Practice.
Compare the external attack surface inventory with the vulnerability scanner’s target list. A complete scan report can still leave a significant gap if an exposed VPN gateway or test application was never included in the scan.
The comparison identifies assets missing from either source, confirms ownership and records how discrepancies were resolved. Asset discovery and vulnerability scanning are stronger evidence when their coverage can be reconciled.
A patch dashboard shows compliance today. It cannot show that vulnerabilities were treated within the defined timeframes.
Keep release dates, installation timestamps, missed deadlines, approved compensating controls and verification results. For remediation tickets, the closure record shows that the treatment was checked, for example through a rescan dated after the change. A change marked complete does not show that by itself.
Historical records also reveal whether the process works consistently. Repeatedly missed patch deadlines or drift findings that remain open are relevant even when the current configuration appears secure.
ASD’s assessment process guide asks whether evidence is recent enough to reflect the current implementation and whether the action operates consistently across the domain.
A dated configuration export is generally stronger than an isolated screenshot because it provides a more complete technical record. Where screenshots are used, they need to show the date, the affected device and the setting being assessed.
Firewall rule reviews, drift tickets and filtering logs connect the observed control state to its review or remediation history. For filtering, keep evidence that destination lists and detection rules are maintained, alongside the records of blocked traffic.
Appliance log forwarding is rated in this domain under IT.DET-01.2. ASD Essentials and SIEM covers the relevant log sources and their use in detection and investigation.
Boundary services also appears in ASD Essentials for operational technology and cloud. The applicable actions differ with each environment and its operating constraints.
The OT chapter places Boundary services in priority phase 1 alongside Critical processes and services. It adds Remote access to operational technology and Operational technology isolation principles.
Remote connections terminate in the OT DMZ, sessions are time-bound and the capability to isolate vital OT is maintained. Traffic is captured on both sides of OT-connected DMZ boundaries.
These controls restrict access between external environments and operational systems while keeping the ability to monitor and manage those connections.
ASD Essentials for OT covers the applicable actions and operational considerations.
In the cloud chapter, Boundary services includes integrations, APIs, gateways, internet-facing services and remote access connecting SaaS and PaaS services with external environments.
The security of these boundaries may depend on controls operated by the organisation and controls managed by the cloud provider.
Some SaaS vulnerability remediation actions carry a Provider marker, so supplier responsibility and assurance have to be considered alongside the organisation’s own controls.
ASD Essentials for cloud explains the relevant actions and how provider-managed controls are addressed.
ThreatDefence runs a 24x7 SOC with its team based in Australia and a 3 min average response under guaranteed SLAs. Threat hunting and an incident response retainer are included in the standard service. Response actions stay within the authority each customer approves, and case records can be exported for an assessor or at the end of a contract.
Australian customers’ data and AI processing stay in Australia. ThreatDefence does not certify organisations; the assessor determines ASD Essentials ratings.
Attack surface management identifies internet-facing assets and exposures, including forgotten test sites and open administrative portals, for reconciliation against the asset inventory.
Network detection and response identifies reconnaissance and command and control beaconing in traffic crossing the network boundary.
The free ASD Essentials Navigator maps every principle and action by chapter and priority phase, and turns your ratings into a board summary. Readers new to the framework can start with the five-minute ASD Essentials explainer, which walks through principles, actions, domains, priority phases and ratings.
Open the ASD Essentials Navigator Start the 5-Minute Explainer Explore ASD Essentials Compliance
See how ThreatDefence automates security monitoring, compliance and cyber risk management in one platform.
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
Δ
A boundary service is an asset that manages connectivity between environments with different trust levels. Examples include VPN concentrators, firewalls, web applications, API endpoints, email gateways and remote access solutions. Internet-facing services and exposed non-production systems are generally in scope. An asset may also belong to another domain, such as Privileged environments, where its function and access requirements overlap.
Boundary services are in priority phase 1 because internet-facing systems and external access gateways are common targets for adversary scanning and exploitation. Compromise may provide an initial entry point into internal environments. ASD places Boundary services alongside Identity services because addressing them together strengthens the protection of external access pathways and the identities used to access systems and services. Priority phases guide implementation order. They are not a measure of maturity.
The Essential Eight’s Patch applications and Patch operating systems strategies map primarily to Vulnerability management, with supporting coverage from Asset identification and Legacy system management. Existing scanning, patching and remediation records can be reused where they support the relevant ASD Essentials actions. The main change is the use of organisation-defined, risk-based treatment timeframes, with verification of remediation effectiveness. The Essential Eight remains maintained alongside ASD Essentials.
ASD Essentials sets no single fixed patching deadline for internet-facing systems. The action asks for updates within defined risk-based timeframes or automatically where operational impact is low, and the indicators rate an absence of defined timeframes as not effective. Exposure, exploit availability and vulnerability severity inform prioritisation. Applicable ISM, regulatory and other mandatory deadlines continue to apply. By comparison, Essential Eight Maturity Level One specifies 48 hours for critical or exploited vulnerabilities affecting online services.
within defined risk-based timeframes or automatically where operational impact is low,
Yes. Firewalls, VPN concentrators and other applicable boundary appliances are covered by the vulnerability scanning action IT.PRO-06.1. ASD’s indicators assess whether routine scanning covers applicable assets, includes both software and configuration weaknesses and produces results that are reviewed and prioritised. Full effectiveness also expects relevant advisories to be regularly reviewed and assessed for impact. For comparison, Essential Eight Maturity Level One specifies daily vulnerability scanning of internet-facing servers and internet-facing network devices.
An unpatched boundary appliance needs documented risk treatment, compensating controls and a path to replacement or decommissioning where support has ended. ASD’s remediation action permits treatment based on exploitation, exposure, criticality, impact and compensating controls, while patching indicators expect delayed patches to have documented and approved compensating controls. The unsupported asset also falls under GOV-14 Legacy system management. Keeping an unsupported system operational without a replacement or decommissioning path is rated as not effective.
based on exploitation, exposure, criticality, impact and compensating controls,
Yes. Content filtering (PRO-09) applies in Boundary services. It covers outbound content inspection, blocking connections to known malicious or untrusted destinations and inspecting inbound content from external or untrusted sources. ASD’s indicators consider coverage across applicable traffic paths, the use of current threat intelligence and maintenance of filtering rules. They also look for blocked inbound content to be logged and available for review. Content filtering has no direct Essential Eight equivalent.
to known malicious or untrusted destinations
Review each vendor security advisory, assess it against the organisation’s assets and act within defined risk-based timeframes. Action IT.PRO-16.2 asks organisations to track exposure using advisories and threat intelligence and act within timeframes proportionate to the risk. ASD’s indicators rate unreviewed advisories as not effective. Containment without investigating evidence of exploitation is partially effective. Relevant findings, suspected supply chain compromises and unresolved treatment feed into incident response and risk tracking.
act within timeframes proportionate to the risk.
ASD Essentials Identity Services and ITDR
ASD Essentials Visibility and Response
ASD Essentials Explained: Framework, Chapters and Enterprise IT