AI agents investigate every alert, add context, and prepare cases for response, on a full-stack SecOps platform that captures and correlates all your security data.
Cloud-based SIEM platform providing visibility across all your data sources
Every alert investigated, with a verdict and the evidence behind it
Manage your external footprint, publicly available data, and Dark Web leaks
Log management and threat detection across any of your log sources
Get ultimate assurance that your environment is free from threat actors
Fully featured distrubuted NDR for on-premises and public cloud environments
A SecOps platform purpose-built for industrial and OT environments
Integrated endpoint agent providing deep visibility, response and forensics
Deploy honeypots and honeytokens and stay ahead of threat actors
24x7 security operations from our Australian SOC. AI investigates every alert, and experienced analysts validate findings and contain threats around the clock.
24x7 managed detection and response across endpoint, network, cloud, identity, and log sources
Eyes-on-glass SOC and continuous threat hunting
Expert hunters and AI agents find attacker activity your alerts missed
Quickly recover from cyber attacks and breaches
ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24x7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Essential Eight monitoring, reporting, and evidence for ongoing compliance
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
Articles on security operations, AI and compliance
Events, awards and company news
Read what our customers say about us
Solution briefs and datasheets
How we keep your data secure
Technical support and knowledge base
Guides, case studies, and advisories in one place
How AI agents investigate alerts and run security operations
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to incident response and digital forensics
Where SOAR playbooks fit and where AI agents take over
November 2, 2026
October 31, 2026
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Embed security operations, threat intelligence and exposure data in your product
Sovereign SOC for Australian MSPs and MSSPs, with onshore analysts and client data
Set the rules for closing alerts automatically, with evidence checks and review
How MSPs deliver branded security monitoring with a SOC partner
ThreatDefence was an official partner of the Cyber Resilience Summit NSW, 29 October 2026 at Hilton Sydney.
Our team was back at BSides Canberra, and our cyber quiz was a hit again.
Two days in Perth with our partner Ever Nimble, on security operations and cyber resilience.
Sponsors of the AUSCERT Cyber Security Conference on the Gold Coast.
Sponsors of the Gartner Security & Risk Management Summit in March.
Sponsors of the Cyber Security for Critical Assets Summit in Perth, February 2026.
Expert conversations with speakers and attendees at CyberCon Melbourne 2025.
Build a security service your clients know as yours. Define the offer, connect their tools, and agree how your team and SOC provider will investigate threats and respond.
Launching a branded SOC service brings monitoring, investigation, and agreed response into your MSP’s offering. A specialist provider can supply the platform and analysts while your team manages clients and its agreed delivery responsibilities.
The launch moves through these stages:
Assign a service owner, assess your team’s capacity, and choose suitable launch clients.
Define the offer, select provider support, agree responsibilities, and prepare your team and client agreements.
Connect client environments, verify coverage, test escalation, and deliver the first reports.
Resolve recurring issues and use operational results and client feedback to guide growth.
Your existing client knowledge and IT processes give you a starting point. The additional work is making security investigations and response part of everyday service delivery, including when an urgent case arrives outside business hours.
You do not need an internal SOC to add security services to your MSP. You need people who can own the service, support investigations, and act on the responsibilities your business retains.
Check these areas before launch:
Name someone accountable for quality, reporting, unresolved issues, and changes to the offer.
Assign primary and backup responders for urgent findings, including outside business hours where required.
Make critical systems, expected activity, and authorized decision-makers available to investigators.
Train engineers on cases and response procedures. Give account managers a clear explanation of the service and a route to specialist help.
Protect the administrative accounts, remote access, and management tools your team uses to reach clients.
Keep procedures, approvals, and follow-up tasks accessible so the service does not depend on an individual engineer’s memory.
If an internal-use deployment is available, start in your own environment. Work through a finding, an escalation, and a report so the team experiences the service before introducing it to clients.
Start with a manageable group of existing clients whose environments your team understands. Look for a clear need and the practical ability to get the service running: access to tools, available contacts, and someone authorized to approve work.
Insurance questions, customer requirements, or a recent incident can open the conversation. Choose representative environments that help you test a repeatable service rather than accepting every interested client at once. A complex estate can be suitable if the expertise and access are available.
Agree review dates and explain the setup process. Each client should know what becomes live first, what remains incomplete, and who will handle urgent findings during onboarding. Record unresolved prerequisites with an owner.
Your service description should answer the practical questions: what is monitored, who investigates, and what happens when action is needed. Build the scope around the client’s environment and the capabilities your team and provider can deliver.
State when monitoring, investigation, and response support operate. A 24x7 offer needs to account for weekends and public holidays.
Identify the identity, endpoint, email, cloud, firewall, network, and other sources included.
Explain how alerts are assessed, supporting evidence is gathered, and findings reach decision-makers.
Specify whether the service advises, carries out authorized containment, or provides broader incident support.
Assign responsibility for fixing underlying issues and verifying completion.
Define acknowledgment, investigation, notification, and action targets, including when each clock starts.
Identify specialist investigations, recovery work, and projects that need separate arrangements.
Confirm whether full incident response and forensics are included. White Label MDR and Threat Intelligence explains response scope in more detail.
Set packages and prices around the work required to deliver the service. The white-label SOC pricing models guide covers tiers, pricing units, and margin.
Compare white label MSSP solutions against the service you intend to launch. Check support for client tools, multi-tenant operations, branding, and the responsibilities you want the provider to handle.
An AI SOC platform can help your team manage triage, investigations, approvals, and reporting across clients. Look for evidence your analysts can review and controls that let you set procedures and response permissions per client. If you intend to bring more work in-house later, assess how your own analysts can join those operations.
Ask what onboarding assistance, technical training, and sales support are available. The guide to choosing a white-label SOC provider covers provider evaluation and testing in a trial.
Assign someone to perform each activity, approve it where required, and own the next step. The example below shows a provider-supported launch; agree the actual split for your service and each client.
Keep the agreed responsibilities with the client record and update them when staff or scope changes. White-label and co-managed services can involve different levels of MSP participation. The comparison of white-label, MSSP, and co-managed models explains those arrangements and their liability implications.
Agree how the security service will work before monitoring begins. Existing IT support agreements may need updating so clients understand the added coverage and their role when the SOC raises a finding.
Record included environments, known gaps, and dependencies.
Name authorized approvers and document actions already approved in advance.
Set channels, contacts, update frequency, and a backup route if nobody answers.
Identify who supplies context, approves changes, and completes work outside the service.
Define how new sites, applications, and critical systems enter scope.
Agree data location, access, retention, and end-of-service arrangements too. The White Label SIEM for MSSPs guide covers those requirements.
A repeatable onboarding process helps you launch each client consistently. Use standard setup steps, then add the context and procedures that make the service fit that client.
Record covered environments, critical assets, authorized contacts, backup approvers, and site hours. Compare expected users and devices with available inventories and assign owners to gaps.
Connect tools using supported integrations and authorized access. Check representative events for useful fields, correct timestamps, and delivery delays. Confirm that investigators can retrieve the evidence required for the agreed service.
Document critical services, privileged identities, approved administration tools, network ranges, and maintenance windows. Give known weaknesses and accepted exceptions an owner and review date.
Where supported, route cases into your PSA or ticketing system. Test client mapping, priority, queue, and acknowledgment. Verify that the ticket reaches the person responsible for acting on it.
Work through initial alerts with the provider and client. Resolve suspicious findings, confirm expected activity, and retain the evidence behind tuning decisions. Keep exclusions narrow enough to preserve detection of unrelated threats.
Check portal access, notifications, reports, and contacts under your brand. Run an authorized test through investigation and escalation, including a scenario where the primary contact is unavailable.
Record live coverage, remaining limitations, service targets, and outstanding tasks. Tuning can continue after launch, but genuine threats need handling throughout setup.
At the first review, compare the live service with the agreed scope. Apply the same checks to sources added later so coverage remains reliable as the environment grows.
An escalation procedure needs to get the right finding to someone who can act. Connect severity and business impact to a named responder, an agreed channel, and a required next step.
Use the following as a starting structure, with timing and routing agreed per client.
Every escalation should identify affected systems, the assessment, actions already taken, and the decision or work required. Include the case owner and next update time.
If a contact does not respond, follow the backup route and record the attempt. Actions authorized in advance remain limited to their agreed scope; an unanswered call does not expand that authority.
Rehearse an overnight incident, an unavailable approver, and a missing evidence source. Confirm that a person accepts ownership. A sent email or automated ticket acknowledgment alone does not complete the handover.
Existing clients already know your team. Explain how the security service adds investigation and response to the support they receive, using examples relevant to their business.
Discuss insurance questions, customer requirements, or known security concerns.
Show who investigates suspicious activity, who responds, and which decisions remain with the client.
A scoped assessment can illustrate observed weaknesses, provided its limits are clear.
Walk through a sample case or report so clients know what to expect.
Supply an accurate service description, answers to common questions, and access to a technical lead.
Explain what is already covered and obtain agreement for additional services.
Adapt provider sales material to your actual offer. Claims about prevention, compliance, or guaranteed outcomes need to match the service scope and supporting evidence.
Reports should make the service useful and understandable, including during quiet months. Explain what was investigated, what coverage was available, and which issues still need a decision.
Define response metrics clearly. Provider acknowledgment, investigation, client approval, and containment measure different steps, so show when each clock starts and stops.
Include source health alongside incident activity. A silent source is a coverage gap even when no threats are reported. Give recommendations an owner and next step, and carry them forward until resolved or explicitly accepted.
Use the first quarter to establish reliable delivery before expanding widely. The timeline below is illustrative, with progress depending on client readiness, access, and validation.
Define the offer, arrange provider support, train your team, and agree responsibilities and client expectations. Onboard the first client when prerequisites are ready, using the experience to refine your setup process.
Bring the remaining launch clients into service at a manageable pace. Review findings, resolve collection issues, test escalation, and deliver the first reports. Check the work your team must perform alongside the provider.
Review client feedback, onboarding effort, escalation workload, reporting quality, and service economics. Fix recurring problems before approaching the wider client base.
Continue tracking gaps and time spent per client after launch. Add environments at a pace that lets your team maintain the agreed service, using results to decide where more training, automation, or provider support is needed.
ThreatDefence gives MSPs and MSSPs one partner workspace on an AI SOC platform with a 24x7 SOC behind it. Set up a separate tenant for each client, with connectors, context, and procedures tracked through onboarding and the first review.
Become a Partner
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
Δ
Define your security offer, assign a service owner, and arrange the platform and people needed to deliver it. A specialist SOC provider can supply monitoring and investigation while you establish onboarding, escalation, and reporting with a manageable group of existing clients.
An MSP manages IT services. An MSSP specializes in security services such as monitoring, investigation, and response. The roles can overlap: an MSP can add managed security services without setting up a separate company.
No. A provider can supply analysts for the monitoring and investigation work you agree. Your team still needs to own the service, coordinate client decisions, and complete its assigned remediation tasks.
Begin with a defined monitoring and response service for the systems most important to your clients. Identity, email, and endpoints are common starting points. Include other sources where they are needed to investigate threats and deliver the agreed coverage.
Timing depends on access, source readiness, integrations, and the procedures that need agreement. Collection may start quickly, but verify coverage and escalation before declaring the client fully live. Record any remaining limitations and who will resolve them.
Requirements depend on your market, clients, and applicable rules. Check expectations for the sectors you serve, and distinguish your MSP’s qualifications from your provider’s. A provider’s certification does not automatically extend to your business.
Agree the monitoring scope, response authority, communication process, data arrangements, and client responsibilities. Record named contacts, backup approvers, and the route for urgent decisions when the primary contact is unavailable.
Provide incident updates, regular service reports, and reviews suited to client leadership. Show coverage, investigations, actions, limitations, and priorities, with clear owners and next steps for outstanding work.
White-Label SOC vs MSSP vs Co-Managed SOC
White Label MDR and Threat Intelligence
Cloud Security for MSSPs