AI agents investigate every alert, add context, and prepare cases for response, on a full-stack SecOps platform that captures and correlates all your security data.
Cloud-based SIEM platform providing visibility across all your data sources
Every alert investigated, with a verdict and the evidence behind it
Manage your external footprint, publicly available data, and Dark Web leaks
Log management and threat detection across any of your log sources
Get ultimate assurance that your environment is free from threat actors
Fully featured distrubuted NDR for on-premises and public cloud environments
A SecOps platform purpose-built for industrial and OT environments
Integrated endpoint agent providing deep visibility, response and forensics
Deploy honeypots and honeytokens and stay ahead of threat actors
24x7 security operations from our Australian SOC. AI investigates every alert, and experienced analysts validate findings and contain threats around the clock.
24x7 managed detection and response across endpoint, network, cloud, identity, and log sources
AI investigations and 24x7 MDR on the Microsoft Sentinel you already own
Eyes-on-glass SOC and continuous threat hunting
Expert hunters and AI agents find attacker activity your alerts missed
Quickly recover from cyber attacks and breaches
ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24x7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Essential Eight monitoring, reporting, and evidence for ongoing compliance
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
Articles on security operations, AI and compliance
Events, awards and company news
Read what our customers say about us
Solution briefs and datasheets
How we keep your data secure
Technical support and knowledge base
Guides, case studies, and advisories in one place
How AI agents investigate alerts and run security operations
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to incident response and digital forensics
Where SOAR playbooks fit and where AI agents take over
Free ebook: modern security operations with Microsoft Sentinel
November 10, 2026
November 6, 2026
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Embed security operations, threat intelligence and exposure data in your product
Sovereign SOC for Australian MSPs and MSSPs, with onshore analysts and client data
Set the rules for closing alerts automatically, with evidence checks and review
How MSPs deliver branded security monitoring with a SOC partner
ThreatDefence was an official partner of the Cyber Resilience Summit NSW, 29 October 2026 at Hilton Sydney.
Our team was back at BSides Canberra, and our cyber quiz was a hit again.
Two days in Perth with our partner Ever Nimble, on security operations and cyber resilience.
Sponsors of the AUSCERT Cyber Security Conference on the Gold Coast.
Sponsors of the Gartner Security & Risk Management Summit in March.
Sponsors of the Cyber Security for Critical Assets Summit in Perth, February 2026.
Expert conversations with speakers and attendees at CyberCon Melbourne 2025.
The best AI SOC platform fits the work your team needs to complete.
Compare 12 AI SOC platforms for 2026, from investigation software that connects to existing tools to broader security platforms and services with human analysts.
AI SOC vendors do not all sell the same thing. Some automate investigations for a SOC you operate. Others provide workflow-building tools, add AI inside an existing security suite, or combine software with managed security services.
An investigation agent may produce a strong assessment without providing anyone to review an urgent escalation. A managed service may include analysts but cover only specified products or response tasks. Compare what the proposed service will actually do before comparing its automation claims.
This review considers investigation depth, integration capabilities, human services, provider support, and publicly described pricing units. Missing public information remains unspecified rather than being treated as an absent capability.
Radiant Security is not a separate entry. Cribl announced in August 2026 that it acquired technology assets from Radiant’s AI SOC product. That announcement concerned product technology assets, not an acquisition of the entire company.
The table summarizes published product models. Separate or optional human services should not be assumed to be included in the software subscription. Blank cells mean the reviewed sources did not establish the detail.
Suitable for: Organizations and MSPs seeking AI investigation and a human SOC together.
ThreatDefence combines an AI SOC platform with a 24x7 Security Operations Center. AI agents investigate every alert across connected tools, query live data, and prepare cases with verdicts and evidence. Analysts review findings and coordinate response under each customer’s permissions and approval rules.
SIEM, NDR, endpoint visibility, deception, threat intelligence, and AI triage are provided under one license.
Included analysts work every case around the clock.
Connections cover firewalls, EDR, identity, email, cloud, and custom sources, with approved actions through those tools.
Multi-tenancy and white-label delivery let partners operate under their own brand.
Hosting is in Australia and the United States, with customer data and AI processing kept in the customer’s region.
Define response authority and escalation contacts during onboarding because the service includes ThreatDefence analysts.
Explore the AI SOC Platform
Suitable for: Enterprise SOCs and MSSPs combining agent-led analysis with configurable automation.
Torq brings Auto Triage, case management, Socrates, and customizable agents together with its hyperautomation engine. Its published approach combines agents that interpret findings with workflows that carry out defined processes.
Torq lists 300 prebuilt integrations and tools for building additional connections. Verify the evidence queries and actions available for your required products.
Its documentation describes workspaces and cross-workspace sharing of integrations, workflows, and other resources.
Assess who will build, test, and maintain the workflow logic, including how changes reach client environments.
Evaluate: Demonstrate a complete investigation and response workflow. Test any autonomous-closure claim on your own alerts and policies; published customer results do not establish the rate your deployment will achieve.
Suitable for: SOCs and MSSPs adding automated investigation to their existing detection tools.
Dropzone AI describes software-executed investigations that query connected tools and produce findings with supporting evidence. Its current offering also includes threat hunting, threat intelligence, and detection engineering agents.
The vendor positions its agents above the existing security stack rather than requiring replacement of the detection tools.
MSSP packaging supports separate client environments and pooled investigation capacity.
The public page describes enterprise sizing by employees. MSSP packages are assembled around agents, capacity, and tenancy requirements.
Evaluate: Confirm who handles human escalations and which response actions are supported in the quoted setup. Software execution is not the same as an included human SOC service.
Suitable for: Teams seeking an investigation platform with an optional human escalation service.
Prophet Security describes agents spanning investigation, response, hunting, and detection engineering. It says the platform integrates with existing tools and deploys in a dedicated single-tenant environment, with a bring-your-own-key option.
Optional Watchtower provides 24x7 expert involvement for malicious or inconclusive determinations.
Prophet says Watchtower analysts assess impact and guide or execute incident response.
The vendor describes applying customer policies and environmental context to its assessments.
Evaluate: Separate the software trial from the managed-service discussion. Establish Watchtower’s scope, response authority, escalation handling, and commercial treatment in the actual proposal.
Suitable for: Teams that want forensic analysis built into automated alert investigation.
Intezer combines agentic analysis with endpoint forensics, reverse engineering, network artifact analysis, and sandboxing. Its published capabilities include false-positive resolution, response recommendations, and automated remediation workflows.
Starter covers one alert source, while Complete covers multiple sources and includes custom response workflows.
Complete lists on-demand assistance from security experts. This should be distinguished from an included continuously staffed escalation service.
Intezer publishes endpoint-based packages and multi-tenancy for enterprise and MSSP use.
Evaluate: Test the forensic evidence available from your specific tools. Confirm which sources, response workflows, and expert assistance the quoted package includes.
Suitable for: Organizations comparing a self-operated agentic platform with a managed operating model.
7AI describes agents for detection, investigation, response, and hunting. Its Federated SIEM queries connected security sources, including an existing SIEM, and presents results through a common schema.
The platform includes reusable skills and organizational context for investigations.
Optional PLAID ELITE provides platform operation and a 24x7 team handling security operations, escalations, and response.
7AI publishes a partner program. Confirm the tenant-management and delivery capabilities required for your particular service model.
Evaluate: Demonstrate the required cross-source searches and response actions. Compare the responsibilities retained by your team under the platform-only and managed offerings.
Suitable for: Teams considering a security data platform alongside AI investigation and optional MDR.
Exaforce describes a unified security data layer and real-time knowledge graph supporting Exabots for detection, triage, investigation, and response. Its approach brings logs and configuration data together across identity, cloud, endpoint, code, and SaaS sources.
Customers can operate the platform themselves or use Exaforce MDR, where analysts and agents run a 24x7 SOC.
Exaforce publishes an MSSP and MDR partner offering.
The platform ingests and normalizes data, making source onboarding and coexistence with an existing SIEM important evaluation areas.
Evaluate: Test the sources and history needed for your investigations. Establish which responsibilities remain with your team if MDR is included.
Suitable for: Falcon customers extending investigation and automation within the CrowdStrike platform.
CrowdStrike positions Charlotte AI as a Falcon-native agentic security analyst. Its current product page describes Detection Triage evaluating first-party detections and producing a verdict, confidence score, recommendation, and explanation.
CrowdStrike also publishes agentic workflows and custom-agent capabilities across the Falcon platform.
Falcon Complete Next-Gen MDR is a separate managed-service offering.
Falcon Complete for Service Providers supports managed security delivery through partners.
Evaluate: Check coverage at the feature level. Broader platform support for third-party data does not establish that every Charlotte AI triage feature investigates every external alert. Confirm the modules and entitlements in the proposal.
Suitable for: Singularity customers seeking AI investigation across native and integrated third-party data.
SentinelOne says Purple AI reasons over OCSF-normalized data, supports investigations, and documents findings. Its published approach connects AI-generated verdicts and recommendations with response through Singularity Hyperautomation under preapproved policies.
Coverage depends on the native telemetry and third-party sources made available to the platform.
Wayfinder managed services are offered separately.
SentinelOne describes an API-first, multi-tenant MSSP platform.
Evaluate: Test the whole path from data onboarding to verdict and action. Confirm that required fields survive normalization and that response workflows enforce the intended approval rules.
Suitable for: Teams using Microsoft security products and evaluating AI within those operating workflows.
Microsoft combines Sentinel’s SIEM and automation capabilities with Security Copilot assistance and agents. Supported plugins provide access to enabled Microsoft and non-Microsoft sources within the applicable permissions.
Defender Experts MDR is a separate managed detection and response offering.
Microsoft documents Azure Lighthouse access for Sentinel-based skills against one delegated customer’s workspace at a time. Other multitenant capabilities need separate evaluation.
Sentinel and Copilot have distinct billing models. Copilot uses Security Compute Units, with included capacity for eligible customers.
Evaluate: Test the intended client-access design, supported workloads, licensing, and compute usage. Do not assume one partner deployment supplies every cross-client investigation or execution workflow.
Suitable for: Teams evaluating SIEM, SOAR, threat intelligence, and agentic capabilities together.
Google Security Operations combines security data, detection, investigation, and playbooks. Google documents agents for triage and investigation, threat hunting, and detection engineering, with feature availability varying.
The reviewed Threat Hunt and Detection Engineering agent documentation identifies those features as pre-GA. Confirm availability in the proposed deployment.
Mandiant Managed Defense is separate. Google also documents MSSP environments and federated searches across customer instances.
Core packages are ingestion-based. Documented agentic billing uses Security Tokens, with entitlements and consumption controls that depend on the package and feature.
Evaluate: Establish which capabilities are available now, which are previews, and how agent usage affects cost. Validate the distinction between SOAR environments and the tenant structure used for SIEM data.
Suitable for: SOCs considering a consolidated platform for detection, investigation, and automation.
Palo Alto Networks describes Cortex XSIAM as combining SIEM, SOAR, endpoint, network, and cloud detection on a shared data layer. Cortex AgentiX adds agentic automation with configurable authority and approval requirements.
Separate Unit 42 Managed XSIAM covers deployment, operation, optimization, and 24x7 detection and response.
Cortex documentation describes parent and child tenants for multi-tenant operation.
Data and automation integrations support connections beyond the platform; verify the specific evidence and actions available.
Evaluate: Assess the consolidation project alongside the AI functionality. Identify which existing products, detections, and processes would remain and which would change.
Use the vendor profiles to shortlist an operating model, then compare products within it. Categories overlap, and a single vendor may offer more than one option.
AI SOC capabilities can sit alongside SIEM, SOAR, and XDR or be built into them. Identify the work your current controls already complete before paying for overlapping functions or planning a replacement.
Give shortlisted vendors the same investigation tasks, source access, and approval requirements. A realistic comparison should show what happens after the agent produces its assessment, including review, escalation, and response.
Require a clear distinction between generally available features, previews, roadmap items, and custom implementation. Test what the proposed deployment can deliver today.
A listed integration can mean alert intake, historical search, enrichment, response execution, or only some of these. Those differences affect whether an agent can complete an investigation.
For example, receiving an endpoint detection does not establish that the agent can retrieve its process tree. A connection that reads identity logs does not necessarily have permission to revoke a session.
Ask vendors to demonstrate the exact queries and approved actions your workflows need. Include a failed lookup or unavailable source so you can see whether incomplete evidence is surfaced or quietly treated as a clean result.
Published accuracy figures may use different datasets, alert mixes, labels, and review methods. Closure rates also depend on what counts as a case, which outcomes qualify, and how much authority the customer has granted.
Ask for the definition, denominator, and review process behind a claim. Then measure incorrect benign verdicts, missed escalations, incomplete investigations, and analyst correction time on your own cases.
Confidence is another separate measure. A high score does not independently prove correctness, and agreement with a previous analyst verdict may reproduce an error in the original label.
Use a proof of concept to test the service you intend to operate. A 90-day plan can organize the work, but results should determine progression rather than dates.
Use the first month to connect representative sources while analysts retain closure and response decisions. Include confirmed attacks, routine benign activity, unfamiliar behavior, and cases with missing data.
Check both the findings and the evidence retrieved. Historical tests should withhold final incident notes or other information that would reveal the outcome in advance.
Record analyst assessments independently where practical, then review disagreements against the evidence. Include failed runs and skipped alerts rather than calculating quality only from completed investigations.
Measure review effort, additional queries, corrections, and integration maintenance alongside agent runtime. Check actual usage against the proposed pricing model, including periods of higher alert volume.
After investigation quality is validated, test narrowly authorized closure or response. Verify the target, approval, execution result, suspension controls, and supported recovery steps.
Retain the results so another reviewer can assess them. Consistent wording is less important than supported findings, correct outcomes, and reliable handling of uncertainty.
Before making a selection, establish:
Who receives an urgent case outside business hours and who can act?
Does the proposal include advice, investigation, containment, or broader incident response?
Who approves automatic closure and response, and how are permissions withdrawn?
Which providers receive evidence and model requests, under which processing, retention, and training terms?
How are incorrect closures discovered, corrected, and reported?
How are client-specific settings, tenant boundaries, reporting, and branding managed?
Which software, data, compute, engineering, and human-service charges apply to the required workflows?
The strongest shortlist is one where each vendor can demonstrate the required work and clearly identify what your team still owns.
See AI investigation and the 24x7 SOC working together on a live tenant.
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
Δ
The best fit depends on client tools, investigation requirements, tenant management, response ownership, and service economics. Test representative clients and confirm whether the proposed package includes the required human coverage, reporting, and partner capabilities.
Use the same alerts, source access, investigation tasks, and approval requirements. Compare evidence quality, incorrect decisions, incomplete runs, and total analyst effort. Keep vendor-published claims separate from results observed in your own evaluation.
Not necessarily. Some offerings include analysts, while others provide software or separately packaged human services. Confirm the coverage hours, supported sources, escalation handling, and response responsibilities included in the actual proposal.
Compare the full cost of the workflows you need, including software, data operations, AI capacity, integration maintenance, and human coverage. Use your expected workload for quotes and verify actual consumption during a trial rather than comparing headline subscription prices alone.
Many can, but support varies by product, feature, and integration. Test alert intake, follow-up evidence retrieval, and response execution separately. The presence of a vendor logo in an integration catalog does not establish all three.
Test representative investigations, evidence completeness, incorrect benign verdicts, missed escalations, and failed or unfinished runs. Include missing data and unusual activity. Validate response permissions and execution separately before allowing production actions.
They show catalog breadth, but not investigation depth. Check the supported event categories, historical queries, permissions, and actions for the tools your team actually uses. A smaller set of complete integrations may be more useful for your workload than a larger set of limited connections.
Usually not without understanding their datasets, definitions, and review methods. Request those details and evaluate vendors on a common set of relevant cases. Analyst agreement, confidence scores, and automatic-closure rates measure different things and should not be treated as interchangeable.
AI SOC Platform Guide
AI SOC vs SOAR
Autonomous SOC