AI agents investigate every alert, add context, and prepare cases for response, on a full-stack SecOps platform that captures and correlates all your security data.
Cloud-based SIEM platform providing visibility across all your data sources
Every alert investigated, with a verdict and the evidence behind it
Manage your external footprint, publicly available data, and Dark Web leaks
Log management and threat detection across any of your log sources
Get ultimate assurance that your environment is free from threat actors
Fully featured distrubuted NDR for on-premises and public cloud environments
A SecOps platform purpose-built for industrial and OT environments
Integrated endpoint agent providing deep visibility, response and forensics
Deploy honeypots and honeytokens and stay ahead of threat actors
24x7 security operations from our Australian SOC. AI investigates every alert, and experienced analysts validate findings and contain threats around the clock.
24x7 managed detection and response across endpoint, network, cloud, identity, and log sources
Eyes-on-glass SOC and continuous threat hunting
Expert hunters and AI agents find attacker activity your alerts missed
Quickly recover from cyber attacks and breaches
ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24x7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Essential Eight monitoring, reporting, and evidence for ongoing compliance
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
Articles on security operations, AI and compliance
Events, awards and company news
Read what our customers say about us
Solution briefs and datasheets
How we keep your data secure
Technical support and knowledge base
Guides, case studies, and advisories in one place
How AI agents investigate alerts and run security operations
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to incident response and digital forensics
Where SOAR playbooks fit and where AI agents take over
October 31, 2026
November 2, 2026
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Embed security operations, threat intelligence and exposure data in your product
Sovereign SOC for Australian MSPs and MSSPs, with onshore analysts and client data
Set the rules for closing alerts automatically, with evidence checks and review
How MSPs deliver branded security monitoring with a SOC partner
ThreatDefence was an official partner of the Cyber Resilience Summit NSW, 29 October 2026 at Hilton Sydney.
Our team was back at BSides Canberra, and our cyber quiz was a hit again.
Two days in Perth with our partner Ever Nimble, on security operations and cyber resilience.
Sponsors of the AUSCERT Cyber Security Conference on the Gold Coast.
Sponsors of the Gartner Security & Risk Management Summit in March.
Sponsors of the Cyber Security for Critical Assets Summit in Perth, February 2026.
Expert conversations with speakers and attendees at CyberCon Melbourne 2025.
Build a SOC service that works for your clients and your margins. Compare billing models, calculate the full cost of delivery, and see how growth and incident workload affect your return.
White label SOC pricing determines what you pay for security operations delivered under your brand. Your client price then needs to cover that charge, the work your team retains, and the margin needed to sustain the service.
SOC as a service pricing usually combines a billing unit with a service scope. Two offers priced per user can include very different monitoring, investigation, and response work. Compare the unit and the included service separately.
SOC pricing per user or endpoint can map to counts your clients already understand. Data-based units need different measurements: GB describes data quantity, while EPS describes event rate. Converting between them requires assumptions about event size and measurement periods.
The worked example below uses illustrative inputs, not market rates or a provider price list.
Choose a pricing unit you can explain and manage as clients change. Buying and selling in the same unit simplifies the calculation, but reporting effort and incident work may still grow differently from license counts.
Supplier charges and revenue follow the same population. Fixed delivery costs and unexpected work still affect margin.
More logging can increase supplier charges without creating additional billable users.
Client charges follow data usage while supplier licensing follows people. Define the measurement and explain the model clearly.
Test the price against the mix of systems, users, and workloads permitted within the package.
Calculate effective costs for representative clients. A business with shared devices may have a different cost profile from one where every employee uses several endpoints.
Check how supplier discounts work: per client or across your portfolio, and across all units or only the next band. Those details determine whether growth improves the economics you expect.
The provider invoice is one part of your service cost. Your team may still coordinate access, explain findings, deliver reports, and complete remediation. Include that work before setting a selling price.
Record included capabilities and any existing licenses you still need.
Include chargeable ingestion, searchable storage, archives, retrieval, and queries where applicable.
Allow for triage, specialist review, follow-up, and recurring noise that needs tuning.
Account for integrations and maintenance across additional environments or specialist systems.
Identify what containment and broader incident support are included.
Estimate access coordination, connection work, validation, and initial tuning.
Include reports, reviews, recommendations, and communication outside incidents.
Free provider setup does not eliminate your own onboarding effort. AI and automation can reduce manual work, but use measured savings in your model rather than assuming the work disappears.
The White Label SIEM for MSSPs guide explains the underlying data and retention requirements.
A lower supplier rate can leave more work with your team. Compare the total cost of delivering the same service, including anything you or the client must buy separately.
Which licenses are included, and which remain necessary?
What investigation, tuning, specialist access, and coverage hours does the fee cover?
What containment and incident support are included or charged separately?
What history, retrieval, exports, and queries will the service require?
Are setup, branding, reports, and reviews included?
Use the same period, currency, and tax basis for each comparison. Public direct-customer prices may differ from partner rates, so obtain quotes for the arrangement you intend to deliver.
For evaluation beyond pricing, read How to Choose a White-Label SOC Provider.
Start with a cost-based floor, then consider the value of the service and how it sits in your market. A client price needs to support reliable delivery as well as win the initial sale.
Calculate delivery costs and the selling price needed for your target margin.
Explain the coverage, response capability, and specialist support clients receive, without promising that losses will be prevented.
Compare verifiable alternatives with similar scope rather than an isolated advertised rate.
If the resulting price is difficult to sell, revisit the scope, delivery effort, or supplier costs. Discounting a model that already depends on optimistic assumptions makes the service harder to sustain.
An equivalent in-house service can provide a useful value comparison. Include staffing, tools, and ongoing engineering, while recognizing that outsourcing still leaves work with the client’s team.
Service margin is revenue minus the included delivery costs, divided by revenue. To find the selling price for a target margin, divide cost by one minus the margin expressed as a decimal.
The following example covers one client. Every figure is illustrative and chosen to make the arithmetic easy to follow, rather than represent market pricing.
The client has 200 users, 220 endpoints, Microsoft 365, and a firewall. The MSSP delivers the service on a white-label platform with a provider SOC behind its team.
For a 40 percent gross margin: $2,190 / 0.60 = $3,650 per month, or about $18.25 per user.
Margin and markup are different. Adding 40 percent to cost gives $3,066 per month, which is only a 29 percent margin.
The result measures margin on the listed service costs. Wider company overhead and the treatment of sales costs need separate consideration when assessing net profit.
Scenario testing shows how a working price behaves when client size, supplier charges, or delivery effort changes. Each scenario below changes one input from the original example.
The growth scenario assumes unchanged per-user rates and fixed account-management and onboarding allocations. The volume scenario assumes the platform charge rises proportionally with ingestion; actual billing depends on the supplier’s measurement rules.
Model the incident month as well as the average month. The results can justify clearer scope, a response allowance, additional-work rates, or a different billing unit, rather than an automatic increase in every client’s price.
Make each tier’s coverage and responsibilities easy to understand. Packages should differ in the service delivered, with clear boundaries around included sources, response, and specialist work.
The structure below is illustrative, not ThreatDefence’s packaging or a recommendation to start every client on the narrowest service.
Each tier needs the data and capabilities required for the investigations it promises. Choose around client requirements; a higher package does not automatically establish compliance.
Add-ons can include extended history, vulnerability services, specialist advice, or credential and brand monitoring. Define what is included and how it is billed so you can track its delivery cost.
How to Launch a SOC Service Under Your Brand covers the wider launch process.
Define what the recurring fee covers when a serious incident occurs. Response can be included, provided through an allowance, or purchased separately. Each model needs a clear boundary between included and additional work.
Common arrangements include hours-based allowances, readiness retainers, and case-based or hourly charges. A retainer may reserve access to specialists without including their investigation time, so check the contents rather than relying on the name.
Agree how hours are consumed, whether unused time carries forward, and whether specialist or after-hours rates differ. Define who can authorize extra expenditure and how costs will be reported during the incident.
Check an included retainer against the support you promise clients. White Label MDR and Threat Intelligence explains response scope, while DFIR for MSSPs covers forensic services.
Billing definitions turn a quoted rate into an actual invoice. Agree them with suppliers and clients so changes in the environment do not create unexplained costs or unbilled work.
Specify how employees, shared accounts, servers, virtual workloads, and inactive assets are treated. Buying per employee and selling per directory account can create a mismatch even when both offers say per user.
Agree when counts are recorded and how additions, removals, and partial months affect billing. For usage-based models, establish the measurement point and whether charges follow averages, peaks, or another calculation.
State the charges and notifications that apply above an included allowance. Explain how spending controls affect operations so a billing limit cannot silently become a monitoring gap.
Charge setup separately or spread it over the expected service period. Allocating the cost across monthly invoices does not change when your team performs the work or spends the cash.
Explain when rates can change, how clients will be notified, and how supplier increases or currency movements are handled. Check that your client billing arrangements can accommodate the costs you incur.
Test discounts against the client’s complete delivery cost. Volume or a standardized environment may create savings, but a larger client is not automatically cheaper to serve.
Data return and provider changes are covered in White-Label SOC vs MSSP vs Co-Managed.
Review actual costs per client against the assumptions behind your price. A profitable portfolio can still contain clients whose workload consistently exceeds the allowance.
Compare supplier bills, monitored populations, and client invoices using the agreed definitions.
Capture reporting, meetings, tuning support, and incident follow-up.
Compare actual onboarding effort with the allocation in your model.
Price agreed additions and record the extra work they create.
Monitor included allowances and additional effort during incident-heavy periods.
Confirm reduced prices still support the intended margin and service quality.
Investigate the cause of a margin shortfall before changing the price. Repeated noise may need tuning; unrecorded additions may need a scope update. Other cases may justify repricing or a different delivery arrangement.
ThreatDefence partners set their own service prices and keep the client relationship. Licensing is per user per month, with every SecOps capability under one license and no charge on log volume.
Buy and sell in the same unit, with licensing costs that remain predictable as client log volumes change. White-label branding and an incident response retainer are included, so neither requires a separate provider charge in your cost model.
The AI SOC platform and 24x7 SOC support delivery across your client base. Manage tenants from one console with AI verdicts, open cases, and escalations per client. Branded monthly reports show clients the work delivered under your name.
Become a Partner
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
Δ
The cost depends on the environment, included tools, investigation and response scope, data requirements, and work your team retains. Compare quotes using the same service scope and billing definitions. The figures in this guide are illustrative, not market rates.
Choose a model that follows your costs and is understandable to clients. Matching buying and selling units can help, but fixed delivery costs, retained labor, and incident workload still affect margin.
MDR pricing commonly follows users, endpoints, or assets. SIEM may be licensed by data volume, event rate, sources, users, or infrastructure. Models vary, so compare the included technology and operational work alongside the billing unit.
EPS pricing charges for a licensed processing rate measured in events per second. Check the measurement period, treatment of peaks, and what happens to events above that rate, including any effect on coverage.
Margin measures profit as a share of selling price. Markup measures it as a share of cost. A 40 percent markup produces a margin of about 29 percent.
You can recover setup through a separate fee or spread it across the expected service period. Either way, include your team’s actual effort, even when the provider charges nothing for setup.
Per-user rates or defined size bands can work where they reflect delivery costs. Allow for fixed reporting and onboarding effort, and choose coverage around the client’s needs rather than price alone.
Compare the total cost of equivalent services over the same period. Include required licenses and your team’s retained work, then test how client growth, data changes, and incident workload affect the result.
White Label SIEM for MSSPs
Choosing a White-Label SOC Provider
What Is a White-Label SOC?