AI agents investigate every alert, add context, and prepare cases for response, on a full-stack SecOps platform that captures and correlates all your security data.
Cloud-based SIEM platform providing visibility across all your data sources
Every alert investigated, with a verdict and the evidence behind it
Manage your external footprint, publicly available data, and Dark Web leaks
Log management and threat detection across any of your log sources
Get ultimate assurance that your environment is free from threat actors
Fully featured distrubuted NDR for on-premises and public cloud environments
A SecOps platform purpose-built for industrial and OT environments
Integrated endpoint agent providing deep visibility, response and forensics
Deploy honeypots and honeytokens and stay ahead of threat actors
24x7 security operations from our Australian SOC. AI investigates every alert, and experienced analysts validate findings and contain threats around the clock.
24x7 managed detection and response across endpoint, network, cloud, identity, and log sources
AI investigations and 24x7 MDR on the Microsoft Sentinel you already own
Eyes-on-glass SOC and continuous threat hunting
Expert hunters and AI agents find attacker activity your alerts missed
Quickly recover from cyber attacks and breaches
ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24x7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Monitoring, evidence and a 24x7 SOC in one platform
Compliance monitoring, evidence and board reporting
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
Articles on security operations, AI and compliance
Events, awards and company news
Read what our customers say about us
Solution briefs and datasheets
How we keep your data secure
Technical support and knowledge base
Guides, case studies, and advisories in one place
How AI agents investigate alerts and run security operations
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to incident response and digital forensics
Where SOAR playbooks fit and where AI agents take over
Free ebook: modern security operations with Microsoft Sentinel
How the framework is structured and what changes from the Essential Eight
November 13, 2026
November 10, 2026
November 6, 2026
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Embed security operations, threat intelligence and exposure data in your product
Sovereign SOC for Australian MSPs and MSSPs, with onshore analysts and client data
Set the rules for closing alerts automatically, with evidence checks and review
How MSPs deliver branded security monitoring with a SOC partner
ThreatDefence was an official partner of the Cyber Resilience Summit NSW, 29 October 2026 at Hilton Sydney.
Our team was back at BSides Canberra, and our cyber quiz was a hit again.
Two days in Perth with our partner Ever Nimble, on security operations and cyber resilience.
Sponsors of the AUSCERT Cyber Security Conference on the Gold Coast.
Sponsors of the Gartner Security & Risk Management Summit in March.
Sponsors of the Cyber Security for Critical Assets Summit in Perth, February 2026.
Expert conversations with speakers and attendees at CyberCon Melbourne 2025.
The Essential Eight is the Australian Signals Directorate’s (ASD) set of eight baseline cyber security mitigation strategies for internet-connected IT networks.
The Essential Eight Maturity Model rates how fully an organisation has implemented those strategies, from Maturity Level Zero to Maturity Level Three, with each level designed to resist a more capable adversary.
The November 2023 model still matters after the publication of ASD Essentials on October 15, 2026, because Commonwealth, Defence and critical infrastructure obligations continue to rely on it. ASD Essentials is ASD’s evolution of the Essential Eight and carries broader guidance, but existing Essential Eight requirements continue to apply where mandated.
The Essential Eight strategies help prevent common cyber attacks, limit the impact of a compromise and support recovery. ASD publishes them, and the same set is also known as the Essential 8, ASD Essential Eight or ACSC Essential Eight, after the Australian Cyber Security Centre.
The strategies, using ASD’s names, are:
Fix known application vulnerabilities within defined timeframes. Vulnerability scanning identifies missing patches and applications that need attention.
Address operating system vulnerabilities and replace operating systems no longer supported by their vendors.
Require authentication beyond a password for relevant online services, extending protection to privileged and unprivileged system users at higher maturity levels.
Limit privileged access, use dedicated administrative accounts and environments, validate access rights and record privileged activity.
Restrict the execution of programs, scripts and installers to an organisation-approved set.
Disable macros where users have no business requirement and block macros in files originating from the internet.
Prevent browsers from processing web advertisements and Java, and apply security restrictions to browsers, Office applications and PDF readers.
Back up important data, applications and settings, protect backup repositories and test that information can be restored.
The strategies complement one another. Patching, application control and hardening reduce the opportunities for malicious code to run. Multi-factor authentication (MFA) and privileged access restrictions limit unauthorised access. Backups provide a way to recover when preventive controls fail.
ASD introduced the Essential Eight in 2017 as part of its broader Strategies to Mitigate Cyber Security Incidents. It was designed for internet-connected IT networks. Enterprise mobility and operational technology were outside that design.
The Essential Eight is a baseline. It was never ASD’s complete set of security recommendations, and an organisation may need additional controls based on the threats affecting its environment.
Each Essential Eight maturity level is defined by the adversary tradecraft it is meant to resist. The Essential Eight Maturity Model runs from Maturity Level Zero (ML0) to Maturity Level Three (ML3). Levels One to Three address increasingly capable adversaries, and Level Zero marks weaknesses that prevent an organisation from meeting Level One.
Weaknesses in the organisation’s overall cyber security posture could allow adversaries using Maturity Level One tradecraft to compromise systems or data.
Designed to resist opportunistic attackers using widely available tools, common exploits, stolen credentials and commodity tradecraft.
Addresses more selective attackers who invest additional effort in phishing credentials, bypassing weak MFA and evading security controls.
Addresses adaptive attackers targeting particular organisations, exploiting monitoring weaknesses, using more sophisticated techniques and stealing authentication tokens to bypass stronger MFA.
The levels describe the tradecraft and targeting an organisation aims to resist. They do not identify specific threat groups, and achieving Maturity Level Three does not guarantee protection against every attacker.
The Essential Eight strategies work as a package. ASD expects organisations to reach the same maturity level across all eight before progressing to the next.
Overall maturity is determined by the lowest-rated strategy.
For example, an organisation may satisfy Maturity Level Three requirements for application control, MFA and patching but meet only Level One requirements for backups. Its overall Essential Eight rating cannot exceed Maturity Level One.
An average score would hide that weakness. Under the model, gaps across the complete set of strategies have to be closed before an organisation claims a higher overall level.
The Essential Eight Maturity Model was first published in June 2017 and last reviewed on November 27, 2023. ASD reported no updates during 2024-25.
The main changes in the November 2023 revision were:
Strengthened authentication requirements against credential phishing and authentication bypass.
Moved Microsoft’s recommended application blocklist from Maturity Level Three to Level Two and introduced annual ruleset reviews.
Aligned backup requirements with business criticality.
The November 2023 model is still the published Essential Eight maturity reference after the introduction of ASD Essentials in October 2026.
Each Essential Eight maturity level builds on the one before. Maturity Level Two includes the Level One requirements, and Level Three adds controls against more adaptive attackers and techniques.
The comparison below summarises requirements from the Information Security Manual (ISM) controls ASD associates with each maturity level. Related strategies are grouped for readability.
Maturity Level One focuses on common attack paths. Internet-facing vulnerabilities get short patching windows, relevant online services require MFA and workstations use application control.
Administrative accounts are separated from ordinary user activity. Backups follow business criticality, and restoration is tested through disaster recovery exercises.
Meeting Level One means satisfying the requirements across all eight strategies. Selected controls on a subset of systems do not meet it.
Maturity Level Two adds phishing-resistant MFA for system users, more extensive application control, tighter privileged access management and requirements for applications outside the main software categories.
Centralised logging and incident response become explicit requirements. Protected logs, analysis of internet-facing server activity, incident reporting and enacted response plans give an organisation the means to investigate activity that preventive controls do not stop.
Privileged access also requires periodic revalidation, inactivity checks and controls around administrative environments.
Maturity Level Three extends controls to more systems and attack techniques. Application control reaches non-internet-facing servers and drivers, and critical or exploited vulnerabilities face shorter remediation windows across more software categories.
Stronger administrative protection includes just-in-time access and Secure Admin Workstations. Backup permissions become more restrictive, and event analysis extends to workstations and internal servers.
An organisation targeting Level Three must also keep meeting every applicable Level One and Level Two requirement.
The comparison above is a summary. For a complete implementation checklist, the authoritative requirements remain in ASD’s Essential Eight Maturity Model, including its appendices comparing maturity levels.
The right Essential Eight maturity target depends on the organisation’s threat environment, the consequences of compromise and any government, regulatory or contractual obligation that applies.
ASD’s general guidance suggests:
May be suitable for small and medium enterprises.
May be suitable for large enterprises.
May be suitable for critical infrastructure providers and organisations operating in high-threat environments.
These are general recommendations and carry no mandate of their own. Where an obligation specifies a maturity level, that requirement sets the minimum target regardless of the organisation’s preferred level.
ASD Essentials explained covers policies and regulations referencing the Essential Eight. ASD Essentials for government examines the PSPF and compares published Commonwealth maturity figures.
The Defence Industry Security Program (DISP) requires its members to meet the full Essential Eight at Maturity Level Two.
Assessments against the “top 4” concluded on November 15, 2025. Part B of the DISP questionnaire now contains 107 Essential Eight controls aligned with Maturity Level Two.
For DISP members, Level Two is an applicable requirement, whatever ASD’s general recommendations suggest for an organisation of their size.
Enhanced risk management rules under the Security of Critical Infrastructure (SOCI) framework, introduced in June 2026, accept Maturity Level Two for listed asset classes, subject to a 24-month grace period. Maturity Level One remains the baseline option.
The relevant asset class and applicable risk management obligations determine what an operator needs to implement. A general recommendation to target Level Three does not replace those requirements.
ASD’s maturity model FAQ adds limits that apply when a target is set.
Insurance cannot substitute for an Essential Eight mitigation strategy. An organisation relying on insurance instead of implementing a strategy is assessed at Maturity Level Zero.
Essential Eight maturity and ISM obligations are considered independently. An organisation required to meet Maturity Level Two may still need ISM controls mapped to Level Three because of its data classification.
Implement and assess each maturity level in turn until the target is reached. Higher-level controls can be introduced earlier where practical, but having them in place does not show that the complete lower level has been met.
ASD Essentials carries the Essential Eight strategies into a broader set of principles, actions and domains. Every Essential Eight strategy contributes to one or more principles in ASD Essentials for enterprise IT.
The Essential Eight remains relevant wherever existing obligations require it. ASD Essentials, published on October 15, 2026, extends ASD’s guidance beyond the original fixed set of strategies, but its publication does not automatically replace those obligations.
The mapping below follows Table 2 of ASD’s transition guidance.
The mapping identifies the relevant principles. It does not make the assessment outcomes equivalent.
For example, existing application control may support the Trustworthy software principle, but its evidence still has to show coverage within the applicable ASD Essentials domain. A control that satisfied an Essential Eight requirement is not necessarily effective everywhere the new principle applies.
Logging and incident response previously appeared within individual Essential Eight strategies. ASD Essentials gives these capabilities dedicated principles, explained in the ASD Essentials Visibility and response guide.
The complete framework structure and domain scope are covered in ASD Essentials explained.
Essential Eight maturity evidence can support ASD Essentials, but maturity ratings do not automatically convert into effectiveness ratings. The configurations, test results and operating records behind a rating are more useful than the overall maturity score.
do not automatically convert
ASD says organisations at Maturity Level Two can expect many existing controls to contribute to actions in the early priority phases, while organisations at Level Three are likely to reuse a broader range of evidence. Level One provides a foundation, but more actions may need further work.
can expect many existing controls to contribute to actions in the early priority phases,
The table lists evidence typically produced during Essential Eight maturity assessments, how to collect it and the ASD Essentials actions it can support. The collection methods are common practice rather than ASD requirements.
do not automatically demonstrate an outcome across the entire domain,
A useful maturity evidence record identifies the system tested, the collection date, the applicable requirement and the observed result.
For sampled systems, record how the samples were selected and which environment or domain they represent. A passing result on one workstation does not show that every workstation, or the broader environment, has the same configuration.
Tool output and system exports dated within the assessment period are usually stronger evidence than screenshots alone. Screenshots remain useful when they clearly identify the date, host and tenant.
The maturity result records what was deployed when the assessment occurred. ASD’s assessment process guide marks the limit of that record in one sentence: Deployment is not effectiveness.
Deployment is not effectiveness.
An Essential Eight assessment shows that controls were configured and tested against particular maturity requirements. ASD Essentials also considers whether the relevant actions achieve their intended outcomes across the applicable domain.
For example, an MFA registration export may show phishing-resistant methods for the users included in the original assessment. The same evidence can support IT.PRO-13.4, provided its coverage and currency are appropriate to the domain being assessed.
Keep the link between each record, its original maturity requirement and the ASD Essentials action it supports. Gaps in system coverage or evidence should stay visible and never be counted as successful results.
The broader transition process, gap analysis and reuse of assessment reports and registers are covered in Essential Eight vs ASD Essentials.
ThreatDefence operates a 24x7 SOC with its team based in Australia, providing a 3 min average response under guaranteed SLAs. Threat hunting and an incident response retainer are included in the standard service.
Response actions remain within the authority each customer approves. Case records can be exported for an assessor or at the end of a contract. Australian customers’ data and AI processing remain in Australia.
ThreatDefence does not certify organisations. The assessor determines ASD Essentials ratings.
Maturity Level Two and Three adversaries actively phish credentials, bypass weak MFA and steal authentication tokens. ThreatDefence ITDR detects session token replay, where a stolen session token may allow an attacker to bypass MFA.
The free ASD Essentials Navigator maps every principle and action by chapter and priority phase, and converts ratings into a board summary. Readers new to the framework can start with the five-minute ASD Essentials explainer, which walks through principles, actions, domains, priority phases and ratings.
Open the ASD Essentials Navigator Start the 5-Minute Explainer Explore ASD Essentials Compliance
See how ThreatDefence automates security monitoring, compliance and cyber risk management in one platform.
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
Δ
The eight strategies are patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups.
Together they reduce opportunities for compromise, restrict unauthorised access and support recovery. ASD designed the strategies as a complementary package, so an organisation implements all eight and does not pick individual controls. Each strategy also maps to relevant principles within ASD Essentials.
Yes, the Essential Eight remains required wherever an existing policy, regulation or contractual obligation specifies it. The PSPF and DISP require Maturity Level Two, while SOCI risk management rules recognise the Essential Eight among accepted frameworks.
ASD Essentials was published on October 15, 2026, but its publication did not automatically remove existing Essential Eight obligations. Organisations should continue meeting current requirements until the relevant authorities communicate changes.
Yes. ACSC Essential 8, ASD Essential Eight, Essential Eight and Essential 8 refer to the same set of mitigation strategies published by the Australian Signals Directorate on cyber.gov.au.
The framework contains eight strategies assessed using the Essential Eight Maturity Model. ASD Essentials is ASD’s broader evolution of it, with principles, actions and domains, but the original model remains published and relevant to existing obligations.
Maturity Level Zero means there are weaknesses in an organisation’s overall cyber security posture that adversaries using Maturity Level One tradecraft could exploit.
An organisation is also rated at Level Zero when it relies on cyber insurance instead of implementing an entire mitigation strategy, according to ASD’s maturity model FAQ. Because overall maturity follows the lowest-rated strategy, a single strategy assessed at Level Zero prevents the organisation from claiming a higher overall level.
Maturity Level Two is designed to resist more selective adversaries who actively phish credentials, bypass weak MFA and attempt to evade security controls.
Requirements include phishing-resistant MFA for system users, additional application control, privileged access protections, centralised logging and incident response. Level Two is required for non-corporate Commonwealth entities under the PSPF and for DISP members. ASD’s general guidance also suggests it may suit large enterprises.
No, Maturity Level Three is not a general requirement for most organisations. ASD identifies critical infrastructure providers and organisations operating in high-threat environments as potential candidates.
The PSPF and DISP specify Level Two, while relevant SOCI and state requirements generally identify lower targets. An organisation’s contracts or threat assessment may justify Level Three. The appropriate target depends on applicable obligations and the consequences of compromise.
Yes. Individual Essential Eight strategies can be assessed at different maturity levels, but the organisation’s overall maturity is determined by the lowest-rated strategy.
For example, meeting Level Three for most strategies and Level One for another produces an overall rating no higher than Level One. ASD expects organisations to reach the same level across all eight before progressing, because stronger controls in one area do not automatically compensate for a weaker strategy elsewhere.
Maturity Level Two introduces logging and incident response requirements within the Essential Eight Maturity Model. Level One has no logging requirements in the model.
Level Two includes centralised MFA event logging, protection against log modification and deletion, analysis of internet-facing server logs, incident reporting and enacted response plans. Level Three extends log analysis to workstations and internal servers. ASD Essentials addresses these capabilities through dedicated principles, including DET-01 Centralised event logging.
The Essential Eight Maturity Model was last updated in November 2023, with ASD recording its last review on November 27, 2023. ASD reported no updates during 2024-25, and no later model release had appeared by late 2026.
The revision required phishing-resistant MFA, moved Microsoft’s recommended application blocklist to Level Two with annual ruleset reviews and aligned backups with business criticality. ASD Essentials followed on October 15, 2026.
No. ASD states that Essential Eight maturity levels do not automatically convert to ASD Essentials effectiveness ratings because the frameworks assess different things.
Existing controls and current evidence may support corresponding ASD Essentials actions, but each applicable domain is assessed against its intended security outcomes. Priority phases set the order of implementation and are not maturity levels. An organisation with a previous Level Two or Three result still needs to show effectiveness for the relevant ASD Essentials actions.
ASD Essentials Assessment and Checklist
"Essential Eight vs ASD Essentials: What Changed and How to Transition"
ASD Essentials Visibility and Response