AI agents investigate every alert, add context, and prepare cases for response, on a full-stack SecOps platform that captures and correlates all your security data.
Cloud-based SIEM platform providing visibility across all your data sources
Every alert investigated, with a verdict and the evidence behind it
Manage your external footprint, publicly available data, and Dark Web leaks
Log management and threat detection across any of your log sources
Get ultimate assurance that your environment is free from threat actors
Fully featured distrubuted NDR for on-premises and public cloud environments
A SecOps platform purpose-built for industrial and OT environments
Integrated endpoint agent providing deep visibility, response and forensics
Deploy honeypots and honeytokens and stay ahead of threat actors
24x7 security operations from our Australian SOC. AI investigates every alert, and experienced analysts validate findings and contain threats around the clock.
24x7 managed detection and response across endpoint, network, cloud, identity, and log sources
Eyes-on-glass SOC and continuous threat hunting
Expert hunters and AI agents find attacker activity your alerts missed
Quickly recover from cyber attacks and breaches
ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24x7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Essential Eight monitoring, reporting, and evidence for ongoing compliance
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
Articles on security operations, AI and compliance
Events, awards and company news
Read what our customers say about us
Solution briefs and datasheets
How we keep your data secure
Technical support and knowledge base
Guides, case studies, and advisories in one place
How AI agents investigate alerts and run security operations
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to incident response and digital forensics
Where SOAR playbooks fit and where AI agents take over
October 31, 2026
November 2, 2026
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Embed security operations, threat intelligence and exposure data in your product
Sovereign SOC for Australian MSPs and MSSPs, with onshore analysts and client data
Set the rules for closing alerts automatically, with evidence checks and review
How MSPs deliver branded security monitoring with a SOC partner
ThreatDefence was an official partner of the Cyber Resilience Summit NSW, 29 October 2026 at Hilton Sydney.
Our team was back at BSides Canberra, and our cyber quiz was a hit again.
Two days in Perth with our partner Ever Nimble, on security operations and cyber resilience.
Sponsors of the AUSCERT Cyber Security Conference on the Gold Coast.
Sponsors of the Gartner Security & Risk Management Summit in March.
Sponsors of the Cyber Security for Critical Assets Summit in Perth, February 2026.
Expert conversations with speakers and attendees at CyberCon Melbourne 2025.
Find attacker activity your alerts have missed. ThreatDefence combines expert hunters and AI agents to search months of security data, investigate findings, and turn confirmed threats into action.
Our managed threat hunting service searches for compromise that routine monitoring may miss. Hunters test hypotheses, connect activity across systems, and check legitimate explanations. New intelligence becomes a hunt the same day, with a written result for every search.
Threat hunting is included in our 24x7 SOC. Hunts, alerts, and incidents share the same platform, analysts, and case records, so confirmed findings move directly into response.
Our hunters search every day alongside the SOC team.
An incident response retainer is included. Confirmed compromise moves into response without a new contract, under your agreed authority.
Response commitments are written into the service, with an average response time of 3 minutes.
SIEM, endpoint visibility, network detection, identity threat detection, deception, and threat intelligence support your hunts under one license.
The platform runs in Australia and the United States, keeping customer data and AI processing in the customer’s region. Australian customers receive guaranteed data sovereignty and residency, with the SOC team based in Australia.
For a broader investigation into an intrusion’s extent and duration, we also provide a compromise assessment.
AI agents run our hunting skills across every connected source and months of retained data. They follow suspicious activity across users, devices, and sources, then prepare findings with the evidence and queries behind them. Hunters choose the questions, direct each investigation, and judge what the evidence shows.
Versioned methods for identity, endpoint, network, data exfiltration, and external exposure hunts.
One sweep runs every applicable skill across a tenant and reports findings and data gaps together.
Agents compare findings with approved tools, expected account behavior, and change records.
AI drafts each write-up, and a hunter reviews it before it reaches you.
Search for the behaviors behind an intrusion, including attacks that use valid accounts, signed software, and approved administration tools.
Password spraying before successful sign-ins, token use from new locations, mailbox rules hiding replies, and consented apps reading mail.
Unexpected tasks, services, run keys, startup items, and signed programs loading libraries from user folders.
PowerShell, certutil, rundll32, and remote management tools used outside their approved purpose.
Remote execution, new administrative share access, and unusual logons between machines.
Beacons to rare destinations, DNS tunneling, and attacker traffic through common services.
Bulk downloads, personal mailbox forwarding, transfers to personal cloud storage, and usable leaked credentials.
Hunts map to MITRE ATT&CK. Monthly reporting shows the tactics examined, the evidence searched, and where further coverage is needed.
Every hunt starts with a hypothesis, scope, time window, and data check. AI agents search and gather evidence while our hunters direct the investigation, test explanations, and assess the findings. Queries and results stay visible in the platform.
Explore the AI threat hunting guide and our threat hunting methodology.
When a relevant threat emerges, we search retained data back to its earliest known activity and check every endpoint for persistence that may outlast the logs. Many hunts appear in our security advisories, with SIEM searches your team can run.
Hunt for SSH keys and persistence planted by a trojanized editor extension.
Check exposure to a remote-control flaw that lets a hostile host attack the technician’s connecting client.
Search back to June 2026 for packages that use signed executables to sideload a loader and deliver a cryptominer.
See how retrospective threat hunting checks past activity against new intelligence.
Hunt across every connected source to follow an intrusion beyond a single system.
EDR or Sysmon process, file, registry, image-load, and network events, plus live device checks.
Entra ID sign-ins and audits, Microsoft 365 audit records, mailbox activity, and app consents.
Message trace and delivery records showing who received a suspected lure.
Firewall, DNS, and proxy logs, plus full sessions with network detection and response.
Control plane and audit records from connected accounts.
Leaked credentials, lookalike domains, and exposed services that may explain initial access.
Retention is agreed at onboarding. Reports identify missing sources and coverage limits; live endpoint checks can still find persistence after historical logs expire.
Your monthly hunting report accompanies the service review, showing what we searched, what we found, and what needs attention. Every hunt is documented, including those with no findings.
Confirmed threats go straight to our 24x7 SOC for incident response under your agreed authority. Weaknesses come with remediation guidance. Findings never wait for the monthly report.
Security leaders and boards get a record of the work completed. A no-findings result applies to the evidence searched, rather than proving the environment is free of threats.
Our team drafts detection rules from confirmed, repeatable attacker behavior. Each rule is stored as code, backtested against retained data, and reviewed by a detection engineer before production.
Confirmed attacker activity becomes a case.
A security gap becomes a remediation task.
Missing telemetry becomes a visibility fix.
Scope, sources, window, and limits recorded.
Rule written as code from hunt evidence.
Backtested, then approved by an engineer.
Future matching activity raises an alert.
MSPs and MSSPs can search for an app, address, or behavior across every authorized tenant. Findings stay in each client’s case records, data stays in its region, and every query is logged per tenant.
Deliver hunting reports under your brand. Explore threat hunting for MSPs.
Hypotheses, hunt methods, and frameworks.
Check historical activity against new threats.
Compare hunting and ongoing detection and response.
Cross-client hunts and branded reporting.
Agents working under a hunter’s direction.
We connect your sources, check the available evidence, and agree retention. A full sweep across every hunt area establishes your baseline of findings, completed checks, and visibility gaps. Scheduled hunts follow, alongside searches after every relevant advisory and questions raised by incidents or your team.
Explore threat hunting for your organization, from investigation coverage to reporting and next steps.
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
Δ
ThreatDefence includes hypothesis-led hunts across endpoint, identity, email, network, and cloud, retrospective searches, a write-up for every hunt, and monthly reporting. Confirmed findings lead to detections and, where needed, the included incident response service.
We hunt on a regular schedule, after every relevant threat advisory, and when incidents or customer requests call for it. Your first hunt is a full baseline sweep.
Endpoint and identity data are key, supported by email, network, and cloud records. Each hunt identifies the sources it needs and reports anything unavailable.
As far back as the relevant data is retained, agreed at onboarding. Live endpoint checks can also uncover persistence after historical logs expire.
Yes. Hunting connects endpoint evidence with activity elsewhere and searches for threats EDR may have missed, including account abuse, misuse of approved tools, and attacks revealed by new intelligence.
Yes. ThreatDefence connects to your existing tools through the platform. Its SIEM, network sensors, and endpoint agents can collect missing sources under the same license.
Many appear in our security advisories, including SIEM searches and retrospective hunting steps other teams can use.
Threat Hunting Methodology
Retrospective Threat Hunting
AI Threat Hunting