Sovereign by design
Platform hosted on AWS Australia with Australian-based analysts and IRAP-assessed tooling. All data, personnel and playbooks remain onshore, subject only to Australian law.
Managed XDR
Managed Detection & Response
Sovereign Australian XDR powered by nine global SOCs, AWS Australia hosting and 24x7 human-verified response.
Every alert touched by a human.
Vectra Managed XDR combines the Ensign InfoSecurity global SOC footprint - nine 24x7 operations centres - with a sovereign Australian data plane hosted on AWS Australia. All telemetry, playbooks and personnel remain onshore and subject only to Australian law. AI-driven triage and SOAR-automated playbooks cut dwell time; human analysts make the call on every escalation. The platform is vendor-agnostic: we operate on your existing EDR, SIEM and cloud stack, or stand one up and run it for you as a single-vendor service.
Deep dive into the capabilitiesMean time to detect
<60s
Mean time to contain
<4min
Global SOCs
924x7
Uptime SLA
99.99%
Why teams bet their SOC on Vectra XDR.
The same named team stays with you from kick-off through delivery. Engagements are shaped to your risk profile, not our template library.
Integrated security stack
Pre-integrated best-of-breed detection from Qualys, Tenable, Check Point, CrowdStrike and the wider tier-one vendor mesh - not a single-vendor lock-in.
Global intel, local delivery
Part of Ensign InfoSecurity, APAC's largest pure-play cybersecurity firm. Threat intelligence from nine global SOCs applied to your Australian estate.
Predictable, all-in pricing
Per-asset monthly rate covering people, platform, playbooks and escalation. No per-alert metering, no surprise licence bills, no surge fees.
How the SOC runs, every day.
Every engagement follows the same six-step CREST-aligned methodology. You get visibility into every phase and an audit trail of every action taken by the test team.
-
01
Ingest
Platform-agnostic telemetry pipeline normalises EDR, identity, cloud, network and SaaS logs into a single sovereign data plane.
-
02
Monitor
24x7 behavioural analytics cross-reference your baseline with Ensign global threat intelligence from nine SOCs.
-
03
Respond
Pre-approved SOAR playbooks contain in minutes. Every escalation is named, tracked and auditable end-to-end.
-
04
Improve
Monthly detection review, quarterly threat-model refresh, annual red-team assumption test. The baseline never stays still.
What the service actually covers.
No tiered upsells, no "platinum" package. What you see is what you get - one contract, one team, one number to call.
Expert threat detection
24x7 visibility across endpoint, identity, cloud and network telemetry, correlated in one platform by one team.
SIEM-as-a-service
Managed Sentinel, Splunk, Chronicle, Elastic or DEVO. We own the platform, content, tuning and workflow; you own the value.
Environment tuning
Data ingestion normalisation, noise reduction and detection rules tuned against your baseline - not a generic ruleset.
Intelligent SOAR
Automated triage and response playbooks reduce mean time to resolve from hours to minutes.
Real-time alert triage
Analyst-validated alerts with full context, chain-of-evidence and suggested containment action ready for approval.
Regulator-ready reporting
Audit trails, evidence packs and executive summaries aligned to APRA CPS 234, SOCI Act, IRAP and Essential Eight.
Built for tier-less modern security ops.
Every engagement runs through a unified portal. Scope, schedule, consume findings and measure the program across years of history - without a single PDF attachment hitting your inbox.
24x7 human-verified monitoring
Every escalation reaches a named analyst. No auto-closed tickets, no "possible threat" verdicts, no dashboard-only products.
AI + ML-assisted detection
DEVO SIEM correlates behavioural baselines with global threat intelligence to surface anomalies signature-based tools miss.
SOAR-automated containment
Pre-approved playbooks isolate hosts, revoke sessions and quarantine identities within minutes of confirmation.
Tier-less SOC operations
Flat escalation model - your team speaks directly to the analyst working the incident, not tier-one triage staff.
Sub-minute MTTD
Mean time to detect under 60 seconds for the threats customers actually face. Mean time to contain under four minutes.
Continuous compliance reporting
Monthly business-context reports for execs, weekly detection-tuning reports for engineers. Ready for APRA, SOCI, IRAP.
The metrics that move after day one.
Measurable, reportable, auditable - every outcome tracks to a control in your compliance framework.
-
Mean time to detect under 60 seconds for the threats your environment actually faces
-
Analyst-validated escalations with full context, chain-of-evidence and recommended containment action
-
Containment playbooks executable from the portal with full audit trail for APRA CPS 234, SOCI Act and Essential Eight reporting
-
Direct-line escalation to the senior IR team - no call-tree, no tier-one screening
-
Sovereign data plane on AWS Australia - telemetry never leaves the jurisdiction
Our analysts are cleared and credentialed.
IRAP
PCI-QSA
ISO 27001
SOC 2
CREST
OSCP
GCIA
GCIH
IRAP
PCI-QSA
ISO 27001
SOC 2
CREST
OSCP
GCIA
GCIH
XDR questions our customers start with.
Can't find the answer here? The team responds to scoping queries within one business day - usually faster.
Ask the team directlyDo you bring your own tools, or run ours?
Both. We're platform-agnostic and will operate on top of CrowdStrike, Microsoft Sentinel, SentinelOne, Splunk, Chronicle, Elastic or DEVO. If you don't have a stack we'll recommend one that fits your environment and budget.
Where are your analysts based?
Adelaide, Sydney, Melbourne, Perth and Brisbane - part of a nine-SOC global Ensign footprint. All Australian citizens, all background-checked, clearable to AGSVA Baseline or higher on request.
Is my data actually sovereign?
Yes. The SIEM data plane sits inside AWS Australia (ap-southeast-2 / ap-southeast-4). Telemetry, playbooks and personnel remain onshore, subject only to Australian law.
What's the typical onboarding time?
Four to six weeks for a full production cutover with incremental detection coverage. We can stand up an emergency monitoring capability in 72 hours for active incidents.
How do you charge?
Per-asset monthly pricing for a predictable run-rate, with a one-time onboarding engagement. No per-alert or per-incident metering - it encourages the wrong incentives.
What if we already have an internal SOC team?
Plenty of customers run hybrid. We handle 24x7 coverage and off-hours response while your team owns business-hours investigations and detection engineering. Named IR escalation still reaches the shared queue.
What happens in a declared incident?
Containment starts within minutes via SOAR, with a named senior analyst leading the investigation. Full forensic capture, eradication and written post-incident review included - not a status-only update.
Security, engineered around you.
Talk to an engineer - not a call centre. Most Vectra conversations start with a 30-minute technical briefing and end with a written plan.