Sovereign by design
Platform hosted on AWS Australia with Australian-based analysts and IRAP-assessed tooling. Data, personnel and playbooks stay onshore, subject only to Australian law.
Managed XDR
Managed Detection & Response
Sovereign Australian XDR powered by nine global SOCs, AWS Australia hosting and 24x7 human-verified response.
Every alert touched by a human.
Vectra Managed XDR runs on the Ensign InfoSecurity global SOC network - nine 24x7 operations centres - paired with a sovereign Australian data plane hosted on AWS Australia. All telemetry, playbooks and personnel stay onshore, subject only to Australian law. AI-driven triage and SOAR-automated playbooks cut dwell time, but a human analyst makes the call on every escalation. The platform is vendor-agnostic: we work on your existing EDR, SIEM and cloud stack, or stand one up and run it for you as a single-vendor service.
<60s
Mean time to detect
<4min
Mean time to contain
924x7
Global SOCs
99.99%
Uptime SLA
Why teams bet their SOC on Vectra XDR.
Integrated security stack
Pre-integrated detection from Qualys, Tenable, Check Point, CrowdStrike and the wider tier-one vendor mesh, so you're not locked into a single vendor.
Global intel, local delivery
Part of Ensign InfoSecurity, APAC's largest pure-play cybersecurity firm. Threat intelligence from nine global SOCs, applied to your Australian estate.
Predictable, all-in pricing
Per-asset monthly rate covering people, platform, playbooks and escalation. No per-alert metering, no surprise licence bills, no surge fees.
How the SOC runs, every day.
Ingest
Platform-agnostic telemetry pipeline normalises EDR, identity, cloud, network and SaaS logs into a single sovereign data plane.
Monitor
24x7 behavioural analytics cross-reference your baseline with Ensign global threat intelligence from nine SOCs.
Respond
Pre-approved SOAR playbooks contain in minutes. Every escalation is named, tracked and fully auditable.
Improve
Monthly detection review, quarterly threat-model refresh, annual red-team assumption test. The baseline never stays still.
What the service actually covers.
Expert threat detection
24x7 visibility across endpoint, identity, cloud and network telemetry, correlated in one platform by one team.
SIEM-as-a-service
Managed Sentinel, Splunk, Chronicle, Elastic or DEVO. We own the platform, content, tuning and workflow; you own the value.
Environment tuning
Data ingestion normalisation, noise reduction and detection rules tuned against your baseline, not a generic ruleset.
Intelligent SOAR
Automated triage and response playbooks reduce mean time to resolve from hours to minutes.
Real-time alert triage
Analyst-validated alerts with full context, chain-of-evidence and suggested containment action ready for approval.
Regulator-ready reporting
Audit trails, evidence packs and executive summaries aligned to APRA CPS 234, SOCI Act, IRAP and Essential Eight.
Built for tier-less modern security ops.
24x7 human-verified monitoring
Every escalation reaches a named analyst. No auto-closed tickets, no "possible threat" verdicts, no dashboard-only products.
AI + ML-assisted detection
DEVO SIEM correlates behavioural baselines with global threat intelligence to surface anomalies signature-based tools miss.
SOAR-automated containment
Pre-approved playbooks isolate hosts, revoke sessions and quarantine identities within minutes of confirmation.
Tier-less SOC operations
Flat escalation model. Your team speaks directly to the analyst working the incident, not tier-one triage staff.
Sub-minute MTTD
Mean time to detect under 60 seconds for the threats customers actually face. Mean time to contain under four minutes.
Continuous compliance reporting
Monthly business-context reports for execs, weekly detection-tuning reports for engineers. Ready for APRA, SOCI, IRAP.
The metrics that move after day one.
- Mean time to detect under 60 seconds for the threats your environment actually faces
- Analyst-validated escalations with full context, chain-of-evidence and recommended containment action
- Containment playbooks executable from the portal with full audit trail for APRA CPS 234, SOCI Act and Essential Eight reporting
- Direct-line escalation to the senior IR team, with no call-tree and no tier-one screening
- Sovereign data plane on AWS Australia, so telemetry never leaves the jurisdiction
Our analysts are cleared and credentialed.IRAPPCI-QSAISO 27001SOC 2CRESTOSCPGCIAGCIH
XDR questions our customers start with.
Do you bring your own tools, or run ours?
Both. We're platform-agnostic and will work on top of CrowdStrike, Microsoft Sentinel, SentinelOne, Splunk, Chronicle, Elastic or DEVO. If you don't have a stack we'll recommend one that fits your environment and budget.
Where are your analysts based?
Adelaide, Sydney, Melbourne, Perth and Brisbane, part of a nine-SOC global Ensign footprint. All Australian citizens, all background-checked, and clearable to AGSVA Baseline or higher on request.
Is my data actually sovereign?
Yes. The SIEM data plane sits inside AWS Australia (ap-southeast-2 / ap-southeast-4). Telemetry, playbooks and personnel remain onshore, subject only to Australian law.
What's the typical onboarding time?
Four to six weeks for a full production cutover with incremental detection coverage. We can stand up an emergency monitoring capability in 72 hours for active incidents.
How do you charge?
Per-asset monthly pricing for a predictable run-rate, with a one-time onboarding engagement. We don't meter per-alert or per-incident, since that encourages the wrong incentives.
What if we already have an internal SOC team?
Plenty of customers run hybrid. We handle 24x7 coverage and off-hours response while your team owns business-hours investigations and detection engineering. Named IR escalation still reaches the shared queue.
What happens in a declared incident?
Containment starts within minutes via SOAR, with a named senior analyst leading the investigation. Full forensic capture, eradication and a written post-incident review are included, not just a status update.