Talk to us
AGENTIC SOC · MICROSOFT AND CROWDSTRIKE

Secure theagentic workforce.

Managed detection and response run by governed AI agents, with a named analyst accountable. Every alert is weighed against threat intelligence and your own context. Built on Microsoft and CrowdStrike, and we tell you where your data is held before you sign.

Talk to us

If we are not the right fit, we will say so. See how the SOC runs

Earth seen from space with glowing cyber network routes
THREAT SIGNALPath intercepted
ORGANISATIONAL CONTEXTIdentity verified
GLOBAL THREAT ACTIVITY SIMULATION
01CONTEXT The organisation, mapped
02INTELLIGENCE Threat intelligence, applied
03ASSURANCE Evidence, kept current
SERVICES / WHAT WE TAKE ON

Three ways to work with us.

Context tells us what matters to you, threat intelligence tells us who is coming for it, and assurance proves what we did. These three lines are what you engage us for, and each one shows the pillars it draws on. Take one, or run them together.

SELECT A SERVICE

MANAGED SERVICEONGOING
MANAGED DETECTION AND RESPONSE (MDR) · CONTEXT · INTELLIGENCE · ASSURANCE

Agentic SOC

Security operations run by governed agents across your Microsoft and CrowdStrike security tools, with a named analyst accountable for it.

Suits organisations running Microsoft or CrowdStrike security tools, and nobody with the time to run them.

  • Alert triageAgents work alerts from Microsoft Defender, Entra and Sentinel, and from CrowdStrike Falcon, through to a decision.
  • Context firstEach alert is resolved against the asset, the owner, the data it touches and the authority behind it.
  • Threat intelligenceEach alert is checked against what is known about the attackers, tools and infrastructure behind it, using the intelligence built into Defender and Falcon and public advisories, so effort goes to what is actually targeting organisations like yours.
  • Governed responseAgents use the response actions in Defender and Falcon, inside the limits you set in writing. Anything beyond them comes to a person first.
  • Human coverHours of human cover agreed with you up front, never assumed. Outside them, agents work only inside the limits you set and the queue is picked up when cover starts.
HOW THE WORK MOVESROUND: AGENT WORK · SLASH: A PERSON DECIDES
Signal arrivesAGENT
Context and threat intelligence applied, risk rankedAGENT
Contain or escalateHUMAN
Evidence writtenAGENT
STARTS WITH

A scoping session across your Microsoft and CrowdStrike estate, then the authority model agreed in writing before any agent acts. Tools billed on what you use, such as Sentinel and Security Copilot, are sized and staged with you.

See the five-step workflow
Talk to us about the Agentic SOC
ADVISORYONGOING OR FIXED SCOPE
GOVERNANCE AND DIRECTION · CONTEXT · ASSURANCE

GRC & Strategy

Risk, policy and oversight for an organisation adopting AI and agents, with someone accountable for the direction.

Suits organisations with no security lead, or one who is already flat out.

  • Virtual CISOA named security lead for your executive, your board and the customer security questionnaires you have to answer.
  • AI and agent governancePolicy for what agents may access, who delegates that authority and how it gets reviewed.
  • Security strategyA written plan with a sequence and an owner for each piece of work, sized to the team you actually have.
  • Risk and obligationsControl mapping to Essential Eight or ISO 27001, with the risk register and the evidence kept current.
HOW THE WORK MOVESROUND: AGENT WORK · SLASH: A PERSON DECIDES
Obligations mapped to controlsAGENT
Gaps and changes surfacedAGENT
Risk accepted, funded or fixedHUMAN
Register and evidence kept currentAGENT
STARTS WITH

A short discovery across your risk register, the obligations you answer to and where AI is already being used, including the uses nobody has approved yet.

How decisions become evidence
Talk to us about GRC & Strategy
LICENSINGONGOING CO-MANAGEMENT
MICROSOFT AND CROWDSTRIKE · CONTEXT · INTELLIGENCE

Security Products

Microsoft and CrowdStrike security licences arranged and managed on your behalf, with the onboarding, tuning and co-management that make them worth having.

Suits teams with Microsoft or CrowdStrike security products that were switched on and never finished.

  • LicensingMicrosoft security licences and CrowdStrike Falcon subscriptions managed together, with a written statement of what is licensed per user or device and what is charged on use.
  • OnboardingMicrosoft Defender, Entra, Intune and the Purview capability in your plan, plus CrowdStrike Falcon, deployed to a documented baseline.
  • TuningDetection tuning in Defender and Falcon against your own baseline, with the rules and exclusions written down so you can see what changed.
  • Co-managementWe run the day-to-day with your IT team. You own the tenant and the Falcon console, we do the upkeep.
HOW THE WORK MOVESROUND: AGENT WORK · SLASH: A PERSON DECIDES
Licences and configuration readAGENT
Drift from the baseline flaggedAGENT
Change approved by your teamHUMAN
Baseline updated and recordedAGENT
STARTS WITH

A licence and configuration review of your Microsoft and CrowdStrike estate as it is today, including where the two overlap and whether your Microsoft plan still fits your headcount. Business Premium has a seat cap, and some organisations are at or near it.

Talk to us about Security Products
01AGENTIC FIRST

Best of breed, chosen for the job.

We choose the agentic security tools we judge best for each job, today Microsoft and CrowdStrike, and we tell you why. Agents do the first pass. A named person makes the call.

02SOVEREIGN BY DEFAULT

Australian, and open about your data.

An Australian company and team. Your Microsoft security data lives in your own tenant, and before we start we confirm it is set to an Australian region. For every other tool we use, and for the models that read your data, we tell you where it is held before you sign.

Not sure which line you need? Start a conversation and we will work out what you are trying to cover.

Talk it through
01 / CONTEXT · THE ORGANISATION MAPPED

Context changes
everything.

We map the relationships between people, AI agents, data, assets, permissions, policies and risk, so your organisation can safely scale autonomous work.

HOW WE MAP CONTEXT

One connected view of your organisation.

Understand who owns an asset, what data it can access and which policies apply. Every relationship informs a better decision.

Business contextIdentity & authorityRisk & controls
How the agents act on it
ORGANISATION GRAPHEXAMPLE
Finance agentGOVERNED IDENTITY
DATA ACCESS

Read-only access to approved financial reporting data.

SELECT A RELATIONSHIP TO EXPLORE
02 / INTELLIGENCE · KNOW WHO IS COMING

Know who is coming,
and what they want.

Most alerts are noise. Threat intelligence is how we tell the ones that matter from the ones that do not: who the attackers are, how they get in, and which of those paths lead to your organisation.

ON EVERY ALERT

Weighed against the attacker.

Addresses, files and behaviours are checked against known attacker infrastructure and techniques before anyone is asked to look, so an alert tied to a known threat is treated differently from one tied to nothing.

WHEN NEW INTELLIGENCE LANDS

Hunt for it before it finds you.

When a new advisory or campaign is published, agents check your environment for the same indicators and behaviours. A person decides what to do with anything they find.

FOR THE DECISIONS THAT FOLLOW

Intelligence your leaders can use.

What is being used against organisations like yours, in plain language, to guide where to spend on controls, what to put in front of the board and what to test next.

WHERE IT COMES FROMBuilt into Microsoft Defender and SentinelBuilt into CrowdStrike FalconPublic advisories, including the Australian Cyber Security Centre

We do not run our own intelligence feed, and we will not pretend to. We use the best the platforms and public sources provide, tell you which of it applies to your licences, and put it in front of a person when it matters.

02 / INTELLIGENCE · SECURITY OPERATIONS

Inside the Agentic SOC.

Watch one investigation run, step by step. Agents do the ruling out. A named person makes the call.

What the Agentic SOC covers
INVESTIGATION SIMULATION CLOSED, EVIDENCE WRITTEN

HOW AN INVESTIGATION NARROWS EXAMPLE

THE ALERT

Sign-in from overseas

Where
A country this account has never used
Who
A member of the finance team
Session
Still active
Can reach
Finance reporting data, marked sensitive

WHAT HAPPENED

  1. Alert raised for a first-time country
  2. Logs pulled, address checked against threat intelligence
  3. Account, role and data access resolved
  4. Five explanations raised and tested
  5. Four ruled out, one remains
  6. Proposed: revoke sessions, reset password
  7. Approved by the named analyst
  8. Sessions revoked, password reset, user told
  9. Evidence pack written

EXPLANATIONS IN PLAY 1 of 5 remains

  • Travelling for workSeen in Perth ten minutes earlier
  • Password sprayNo failed sign-ins anywhere
  • New phone or laptopNo new device enrolled
  • Company VPN exitAddress is not a company range
  • Stolen session tokenToken replayed with no MFA prompt

THE CALL

Waiting for the evidence. Nothing is proposed until one explanation remains.

AGENTS PROPOSE

Revoke sessions and reset the password

This is outside what agents may do alone, so it waits for a person.

In this simulation, if nobody approves, the named analyst does.

Approved by the named analyst

Sessions revoked, password reset and the user told.

EVIDENCE PACK

  • Every explanation and why it was ruled out
  • The decision, and who made it
  • The action taken and the outcome
Where the evidence goes
05 / ASSURE

Actions, approvals and outcomes are recorded as evidence you can hand to an auditor.

Rule out what the evidence rules out, and go with the simplest explanation left standing. That is Occam's razor, and it is where our name comes from.

CONTINUOUS ASSURANCEEXAMPLE
FINANCE REPORTING AGENT

Accountable. By design.

  1. ✓
    Identity verifiedDelegated by Finance Operations
    01
  2. ✓
    Policy evaluatedRead-only access · approved data
    02
  3. ✓
    Decision recordedAuthority, action and outcome linked
    03
ONE TRACEABLE CHAIN OF EVIDENCE
03 / ASSURANCE · EVIDENCE OF CONTROL

Every action becomes evidence.

We connect security operations to GRC. Decisions, approvals and outcomes are recorded as evidence you can hand to an auditor.

IdentityKnow which human or agent had authority to act.
GRCMap operational decisions to policies and obligations.
AssuranceMaintain evidence that is ready when it matters.
FAQ / BEFORE YOU BOOK

Questions we get asked.

Straight answers, including where your data is held and how we scope the work.

Ask us something else
What is an agentic SOC?

A security operations centre where AI agents do the repetitive first pass: pulling the logs, resolving who and what is involved, testing each possible explanation and proposing a response. A named person stays accountable and makes the call on anything beyond the limits you set.

How is an AI SOC different from a traditional managed SOC?

Many managed SOCs still have people working an alert queue. Here, agents do the first pass on the alerts in scope and write down why each explanation was ruled out, so people spend their time on decisions. You get the reasoning and the evidence, not just a ticket.

Which security tools does it work with?

Microsoft Defender, Entra and Sentinel, and CrowdStrike Falcon. We build on the agentic security tools we judge best for the job, tell you why we chose them, and scope against what you already run before suggesting anything new.

How does threat intelligence fit in?

Every alert is checked against what is known about the attackers, tools and infrastructure behind it, using the intelligence built into Microsoft Defender and CrowdStrike Falcon, plus public advisories such as those from the Australian Cyber Security Centre. How much of it you get depends on the licences you hold, and we tell you which feeds apply to you before you sign. We do not run our own intelligence feed.

Do the agents act on their own?

Only inside limits you set in writing. Anything beyond those limits waits for a named person to approve it, and every action and decision is recorded as evidence.

Is someone watching outside business hours?

Not by default. Hours of human cover are agreed with you up front, and we tell you plainly what agents do, and what waits for a person, outside those hours.

Who is the named analyst?

A named person on our team who is accountable for your service and for the decisions made on it. You are told who it is before work starts.

What access do you need to our tenant?

The minimum needed, agreed in writing before any agent acts. You keep ownership of the tenant.

Where is our data held?

Your Microsoft security data lives in your own tenant. Before we start we confirm it is set to an Australian region, and we tell you about any service that processes it elsewhere. For every other tool we use, including CrowdStrike Falcon, we tell you where your data is held before you sign, along with where the models that read your data run and where evidence packs are stored. We are an Australian company with an Australian team.

What happens when I get in touch?

You send a short request and we reply by email to arrange a conversation about what you run and what you need covered. If we are not the right fit, we will say so.

Do we need a particular Microsoft licence?

We do not start from a licence requirement. We scope against what you have today and tell you before anything costs extra. Some capabilities need specific plans, and some, such as Sentinel and Security Copilot, are billed on what you use, so we size and stage those with you.

What does it cost?

It depends on what you run and what you need covered, so we scope it first and put the fees in a Statement of Work you can sign. Anything that costs extra, including Microsoft usage-based billing, we show you before you commit.

Who is Occam Cyber for?

Mid-sized Australian organisations, roughly 50 to 500 people, that run Microsoft or CrowdStrike security tools and do not have the team to run them.

NEXT STEP · TALK TO US

Autonomy starts with
trusted context.

Start with a conversation about what you run and what you need covered.

REQUESTCONTACT

Talk to us

Tell us what you run and what you need covered. If we are not the right fit, we will say so.

What are you running today? optional

We reply by email.

We use your details to reply to your enquiry. See our privacy notice.

  1. 01A first conversation

    What you run, what worries you and which of our three lines fits.

  2. 02A look at what you already have

    We scope against the Microsoft and CrowdStrike tools and licences you have today, before suggesting anything new.

  3. 03A proposal you can sign

    Scope, the authority agents get, who is accountable and the fees, set out in a Statement of Work.