AI agents investigate every alert, add context, and prepare cases for response, on a full-stack SecOps platform that captures and correlates all your security data.
Cloud-based SIEM platform providing visibility across all your data sources
Every alert investigated, with a verdict and the evidence behind it
Manage your external footprint, publicly available data, and Dark Web leaks
Log management and threat detection across any of your log sources
Get ultimate assurance that your environment is free from threat actors
Fully featured distrubuted NDR for on-premises and public cloud environments
A SecOps platform purpose-built for industrial and OT environments
Integrated endpoint agent providing deep visibility, response and forensics
Deploy honeypots and honeytokens and stay ahead of threat actors
24x7 security operations from our Australian SOC. AI investigates every alert, and experienced analysts validate findings and contain threats around the clock.
24x7 managed detection and response across endpoint, network, cloud, identity, and log sources
Eyes-on-glass SOC and continuous threat hunting
Expert hunters and AI agents find attacker activity your alerts missed
Quickly recover from cyber attacks and breaches
ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24x7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Essential Eight monitoring, reporting, and evidence for ongoing compliance
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
Articles on security operations, AI and compliance
Events, awards and company news
Read what our customers say about us
Solution briefs and datasheets
How we keep your data secure
Technical support and knowledge base
Guides, case studies, and advisories in one place
How AI agents investigate alerts and run security operations
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to incident response and digital forensics
Where SOAR playbooks fit and where AI agents take over
October 31, 2026
November 2, 2026
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Embed security operations, threat intelligence and exposure data in your product
Sovereign SOC for Australian MSPs and MSSPs, with onshore analysts and client data
Set the rules for closing alerts automatically, with evidence checks and review
How MSPs deliver branded security monitoring with a SOC partner
ThreatDefence was an official partner of the Cyber Resilience Summit NSW, 29 October 2026 at Hilton Sydney.
Our team was back at BSides Canberra, and our cyber quiz was a hit again.
Two days in Perth with our partner Ever Nimble, on security operations and cyber resilience.
Sponsors of the AUSCERT Cyber Security Conference on the Gold Coast.
Sponsors of the Gartner Security & Risk Management Summit in March.
Sponsors of the Cyber Security for Critical Assets Summit in Perth, February 2026.
Expert conversations with speakers and attendees at CyberCon Melbourne 2025.
Deliver a SOC service under your own brand with an Australian provider’s platform and analysts. Define onshore coverage clearly, support local reporting requirements, and give clients evidence of the security work performed.
A white label SOC lets Australian MSPs and MSSPs offer monitoring, investigation, and response under their own brand. You manage the client relationship and set your prices, with the provider supplying the agreed technology and operational support.
Australian clients may also require local data handling, Australian-based analysts, and reporting for assessors, boards, or regulators. Record those requirements individually. Australian hosting does not automatically establish that processing, support access, and every other part of the service stay onshore.
Use precise descriptions in tenders, security questionnaires, and insurance applications. Identify which commitments belong to the SOC provider, your team, or another supplier.
Define onshore delivery across data, processing, access, and people.
The white-label SOC guide explains the wider delivery model.
Onshore requirements can come from procurement rules, legal obligations, or a client’s risk decisions. Australia does not have one universal rule requiring every SOC to operate locally.
Overseas disclosure of personal information can trigger APP 8 safeguards and accountability, subject to exceptions.
Buyers may specify Australian storage, processing, or personnel for the service in scope.
Applicable risk management programs must address relevant hazards, including supply chain and personnel risks.
APRA-regulated entities must assess third parties managing their information assets.
Clients may need evidence of data locations, access controls, and response arrangements.
Australian personnel can assist with local reporting and coordination, with escalation arrangements that work across client time zones.
Check the specific requirement before selecting the service. Procurement conditions may demand Australian delivery even when legislation does not prescribe where the SOC must be located.
Data residency describes where information is stored. Data sovereignty concerns the laws, jurisdictions, and control arrangements that apply to it. Australian storage alone does not determine who can access the information or which foreign legal powers may affect a supplier.
Review collection, analysis, case records, backups, and operational and support access. A sovereign SOC commitment should explain which parts of that service it covers.
Which data centers hold each client’s data, including replicas.
Where queries and detections run, not only where data rests.
Which region the models run in, and whether prompts or evidence leave it.
Where backup copies and long-term retention are kept.
Who can reach client data, from which countries, and how access is logged.
Where the analysts who investigate and respond are based.
Which third parties touch the data, including ticketing and email services.
Include AI processing explicitly. Confirm where model requests run and where prompts and outputs are retained, rather than assuming they follow the location of the SOC data store.
Get a service description you can use consistently in client material and procurement responses. It should name the locations, access arrangements, and suppliers covered by the commitment.
Identify production, archive, backup, and recovery locations.
Confirm where investigations, AI requests, and related service logs are processed and retained.
Establish where analysts, administrators, and support staff work and how their access is controlled.
Identify relevant subprocessors and legal arrangements affecting control of the data.
Record destinations used for tickets, notifications, and exported reports.
Review the statement when integrations, model services, support arrangements, or suppliers change. Keep the client-facing promise aligned with the service being delivered.
SOC records can help clients assess ASD’s eight mitigation strategies against the Essential Eight maturity model. The available evidence depends on connected tools and the records they provide.
Combine those records with configuration checks, testing, and reviews of processes and exceptions. A quiet log does not prove that a control works. Successful backup jobs do not prove that restoration has been tested.
Agree the assessment scope and target maturity level with each client. Essential Eight reporting supports that assessment; purchasing a SOC service does not provide a general Essential Eight certification.
Learn how Essential Eight reporting supports this work.
Reporting obligations depend on the entity, the incident, and the applicable threshold. One incident can trigger several duties, with different deadlines and recipients.
For SOCI reporting, significant impact means material disruption to the availability of essential goods or services. Relevant impact covers availability, integrity, reliability, or confidentiality. An oral report needs written follow-up within 84 hours for a critical incident or 48 hours for another qualifying incident, measured from the oral report.
Under the NDB scheme, an eligible breach generally involves unauthorized access, disclosure, or loss of personal information likely to cause serious harm, where remedial action has not prevented the risk. Do not wait for the assessment period to expire once there are reasonable grounds to believe an eligible breach occurred.
Ransomware payment reporting uses the previous financial year’s turnover, with an adjusted threshold for part-year businesses. Reporting the payment is separate from reporting the underlying incident. Check both obligations where applicable.
Keep observed activity, impact evidence, notification times, and records of when relevant parties became aware. Those details help establish the start of each reporting clock under the applicable rule.
Clients retain their reporting obligations, with providers and advisers assisting as agreed. Providers may also have duties of their own. Make evidence available as it develops rather than waiting for the investigation to finish.
The guide to SOCI Act requirements explains critical infrastructure obligations in more detail.
CPS 234 requires APRA-regulated clients to assess the security capability of third parties managing their information assets. The assessment must reflect the potential consequences of an incident affecting those assets.
CPS 230 adds operational resilience and service provider management requirements. It originally commenced on 1 July 2025, with the current amended version effective from 1 July 2026. Whether a SOC provider is a material service provider depends on the arrangement.
Prepare information financial clients can review:
Relevant independent reports, certificates, assessment scopes, and findings.
Data locations, access controls, and relevant subcontractors.
Evidence of effectiveness, including controls delivered by third parties.
Arrangements that support the client’s reporting deadlines.
Evidence of resilience and arrangements for returning client data.
CPS 234 also requires notification of a material security control weakness as soon as possible and within 10 business days of awareness when timely remediation is not expected. Keep assurance records current throughout the relationship.
Assess each buyer’s requirements against its jurisdiction, information classification, and service scope. Councils, state agencies, universities, and schools do not all operate under the same rules.
Confirm required storage, processing, backup, and access locations.
Check Australian staffing requirements and any specified security clearances.
Identify applicable Essential Eight targets and Information Security Manual requirements.
Establish whether an IRAP assessment or other assurance is required and whether its scope covers the service.
Provide evidence suited to executives, audit committees, and other decision-makers.
Help clients answer insurance questions with dated evidence of their controls and service coverage. Common areas include:
MFA coverage for email, remote access, and privileged accounts.
Deployment and monitoring coverage.
Investigation and response outside business hours.
Protection, access restrictions, and restoration testing.
The response plan and the parties available to carry it out.
Check the policy’s notification, approval, and insurer-panel requirements before an incident. Agree how the client, MSP, SOC, and insurer-appointed responders will coordinate.
State the scope and gaps in each evidence summary. Insurance eligibility and claims decisions remain subject to the policy and the client’s wider arrangements.
A 24x7 SOC still needs contacts and approvals that work in each client’s local time. Daylight saving and state public holidays can affect who is available when an incident occurs.
New South Wales, Victoria, Tasmania, the ACT, and South Australia observe daylight saving. Queensland, the Northern Territory, and Western Australia do not. During daylight saving, Sydney is three hours ahead of Perth: 7 am in Sydney is 4 am in Perth.
Record business hours, escalation contacts, and backup approvers in the client’s local time zone. Account for state public holidays rather than relying on one national calendar.
If you serve New Zealand clients, confirm their agreed data locations and applicable New Zealand privacy obligations. Australian hosting does not remove the need to assess those requirements.
Connect your security service with the evidence clients need for local decisions. Explain what is included and which work they must arrange separately.
Define the data, processing, people, and service components covered by the commitment.
Map available evidence to the agreed scope and maturity target.
Supply timelines and findings for client reporting decisions.
Provide records for accurate application and renewal responses.
Describe investigation and recovery support beyond containment.
Deliver ThreatDefence’s AI SOC platform and 24x7 SOC under your brand. For Australian clients, data sovereignty and residency are guaranteed, the SOC team is based in Australia, and AI processing stays in the same region as the data.
Each client has a separate tenant, with Essential Eight reporting, incident timelines for reporting decisions, and branded monthly reports. Alerts and reports can use your email domain, and cases can flow into ConnectWise, Autotask, HaloPSA, or ServiceNow.
Become a Partner
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
Δ
Yes. Australian SOC providers support services that MSPs and MSSPs deliver under their own brand. Check storage, processing, analyst locations, and support access individually. An Australian office alone does not establish that the entire service operates onshore.
Residency describes where data is stored. Sovereignty concerns the laws, jurisdictions, and control arrangements applying to it. Check processing, access, and supplier jurisdiction alongside the storage location.
Yes. Monitoring and related records can support an Essential Eight maturity assessment. Configuration checks, technical testing, and process reviews are still needed to establish whether requirements are met.
The SOCI Act does not impose a general Australian SOC requirement. Clients must meet their applicable risk management and reporting duties and may separately require onshore delivery through procurement or service conditions.
The deadline depends on the obligation. Qualifying SOCI incidents have 12-hour or 72-hour limits from awareness. CPS 234 requires qualifying incident notification as soon as possible and within 72 hours. NDB assessments must be expeditious, with all reasonable steps taken to finish within 30 calendar days; eligible breach notification is required as soon as practicable.
Yes, if it meets applicable legal and client requirements. Overseas disclosure by an APP entity generally engages APP 8 safeguards and accountability, subject to exceptions. Limited processing arrangements under the entity’s effective control may instead be a use of information. Procurement conditions can still require onshore delivery.
Common questions cover MFA, endpoint protection, after-hours monitoring, protected backups, and incident response. Check policy requirements for insurer notification, approvals, and panel responders as well.
Yes, under an appropriate service arrangement. Confirm storage and processing locations and the New Zealand privacy requirements that apply to the client and service.
What Is a White-Label SOC?
How to Launch a SOC Service Under Your Brand
How to Choose a White-Label SOC Provider