# Cyber Defense Co., Ltd.

> Cyber Defense Co., Ltd. is a managed security operator in Bangkok, Thailand, founded in 2015. It sells only through partners — MSSPs, systems integrators, MSPs and resellers — and never sells direct: the partner owns the contract, the brand and the end-customer relationship, while Cyber Defense runs the security work behind it and does not contract with the end customer. The monitoring and detection lines run on zcr, the security platform built by the same company under the zcr.ai brand, which is why one detection rule can run a single query across every tenant and the cost of adding another tenant stays low.

This file is a map of the site for language models. Every service is priced as a repeatable unit rather than a scoped project, and the rates are published — which is unusual in this category. The partner buys at the partner rate, sets the end-customer price, and keeps the margin.

## Managed delivery

- [Managed delivery catalogue](https://cyberdefense.co.th/managed-delivery): All 11 services Cyber Defense delivers for partners, each with a defined scope and a billing unit.
- [Price list](https://cyberdefense.co.th/pricing): The published rate for every managed service, in two columns — what the end customer pays and what the partner pays for the same unit.
- [Managed SOC Operations](https://cyberdefense.co.th/managed-soc): Our analysts monitor, triage and escalate on your tenant. Your customers call you; we sit behind you in the queue and never appear on the ticket. Billed per endpoint / month.
- [Managed Exposure](https://cyberdefense.co.th/managed-exposure): Continuous external attack surface monitoring on zcrCTEM. Nothing installed, no credentials issued, so a customer can be live the same week you sell it. Billed per domain / month.
- [Managed Leak Detection](https://cyberdefense.co.th/managed-leak-detection): Credential dumps and brand abuse monitored across dark web sources, verified by an analyst before anything reaches your inbox. Billed per domain / month.
- [Managed Penetration Testing](https://cyberdefense.co.th/managed-pentest): Web, API and infrastructure testing against a documented methodology, senior-reviewed, written in your report template with your logo. Billed per web application / monthly quota.
- [Managed Detection Engineering](https://cyberdefense.co.th/managed-detection-engineering): Rules, parsers and tuning for the platform you run, delivered as reviewed code. Keeps your detection current without a dedicated engineer on your payroll. Billed engineer days / month.
- [Managed Onboarding](https://cyberdefense.co.th/managed-onboarding): We stand the platform up for your customer and hand you a working tenant. For reseller partners who sell but would rather not operate. Billed per deployment.
- [Incident Response Retainer](https://cyberdefense.co.th/incident-response): A pre-agreed retainer so that when your customer is breached at 2am, you already have a forensics team and a signed scope instead of a procurement problem. Billed annual retainer.
- [Managed OT Monitoring](https://cyberdefense.co.th/managed-ot): Asset discovery and monitoring for industrial, solar and EV charging environments — where an IT-shaped SOC playbook does not apply. Billed per site / month.
- [Managed Security Awareness](https://cyberdefense.co.th/managed-awareness): Phishing simulation and training run as a programme rather than a one-off campaign. We own the calendar, chase the people who ignore it, and produce the report you present. Billed per learner / month.
- [Managed Code Review](https://cyberdefense.co.th/managed-code-review): Static analysis run properly — pipeline wired, rule set tuned, findings triaged by an engineer — so developers receive exploitable issues instead of ten thousand warnings. Billed per repository.
- [Managed EDR Operations (MDR)](https://cyberdefense.co.th/managed-edr): MDR on the agent you already sell. You keep the EDR licence and the tenant; we run the console — triage, containment and escalation. Billed per endpoint / month.

## Comparisons

- [Cyber Defense vs CyFlare: two SOC operators, one structural difference](https://cyberdefense.co.th/vs/vs-cyflare): CyFlare runs SOC-as-a-Service for MSPs and MSSPs on its own Cyflare ONE platform and states 40%+ partner margins on its own site. Cyber Defense runs the same model from Bangkok on zcr — but sells the platform and the operator as two separate things you are allowed to buy one of.
- [Cyber Defense vs Huntress: a product you resell, or people who run it](https://cyberdefense.co.th/vs/vs-huntress): Huntress sells Managed EDR, ITDR, SIEM, SAT, ISPM and ESPM through MSPs and publishes real per-unit prices on its own pricing page. Cyber Defense sells no product at all — it operates security delivery under your brand. Which one a partner actually needs.
- [Cyber Defense vs Stellar Cyber: a platform to run, or people to run it](https://cyberdefense.co.th/vs/vs-stellar-cyber): Stellar Cyber builds Open XDR and AI-SIEM for MSSPs — multi-tier, multi-tenant, multi-site on one licence, with no rates on its public pricing page when we last checked. Cyber Defense sells the operating team instead: analysts on shift under your brand. Where each one fits, and which half of our own business is the like-for-like comparison.
- [White-label SOC for MSPs, MSSPs and resellers: how the model actually works](https://cyberdefense.co.th/vs/white-label-soc): What a white-label SOC is, what it costs you in control, when it beats hiring analysts and when it does not. Written by an operator that runs one — from Bangkok, only through partners, never in front of your customer.

## Platform

- [zcr.ai](https://zcr.ai): The platform brand of the same company — zcr.ai and Cyber Defense are one legal entity, Cyber Defense Co., Ltd. Two brands on purpose, so a partner can license the platform without buying the operating team, or buy the team without changing platform. zcr covers eight products — zcrLog, zcrSIEM, zcrSOAR, zcrCTEM, zcrWAF, zcrOT, zcrADC and zcrX. Cyber Defense is the operator that runs managed delivery on them.
- [zcrLog](https://zcr.ai/product/zcrlog): Log management and Thai Computer Crime Act traffic-data retention. Winner of the Best Cybersecurity Innovation Award 2025.

## Company

- [Frequently asked questions](https://cyberdefense.co.th/faq): How the partner model works, what the end customer sees, how services are scoped and how they are priced.
- [For Partners](https://cyberdefense.co.th/partners)
- [Pricing](https://cyberdefense.co.th/pricing)
- [About Us](https://cyberdefense.co.th/about)
- [Resources](https://cyberdefense.co.th/resources)
- [Contact](https://cyberdefense.co.th/contact)
- [Security & data](https://cyberdefense.co.th/security)
- [Privacy](https://cyberdefense.co.th/privacy)
- [คลังบทความ / Thai security archive](https://cyberdefense.co.th/th/blog): 53 Thai-language articles on threats, incidents and security operations, written for Thai IT teams.
- [เว็บไซต์ภาษาไทย / Thai site](https://cyberdefense.co.th/th): The Thai site. Every service page, the delivery catalogue, the comparisons and the FAQ have a Thai counterpart under /th.

## Facts

- Cyber Defense Co., Ltd. is a managed security services operator headquartered in Bangkok, Thailand, registered in 2015, with Thai tax ID 0105558158009.
- Cyber Defense sells only through partners and never sells direct. Every engagement is contracted through an MSSP, systems integrator, MSP or reseller, and Cyber Defense has no direct sales team that could approach a partner's customer.
- In managed delivery, Cyber Defense never meets the partner's end customer. Services are delivered under the partner's brand, on the partner's report template, through the partner's own ticket queue, so the end customer sees only the partner. The one published exception is the 24/7 emergency line at https://cyberdefense.co.th/under-attack, which any organisation under attack may call: containment advice is given regardless of who is calling, and the engagement is then contracted through a partner, because Cyber Defense does not contract with end customers.
- Cyber Defense commits to a responder being with the caller within four hours of an incident call, measured from the moment the call is placed rather than from when a ticket is triaged. The emergency line is +66 86-940-1383 and is answered by the Bangkok security operations centre, which is staffed 24 hours a day. Work beyond the one incident included in an incident-response retainer is billed at the rate written into that retainer; Cyber Defense does not publish a single overflow rate.
- Cyber Defense operates on zcr, the security platform it builds itself and sells under the zcr.ai brand, which covers eight products: zcrLog, zcrSIEM, zcrSOAR, zcrCTEM, zcrWAF, zcrOT, zcrADC and zcrX.
- Because Cyber Defense runs on a platform built in-house rather than tooling licensed per customer, a single detection rule runs one query across every tenant, so onboarding an additional customer adds very little cost.
- Cyber Defense prices managed delivery as a repeatable monthly unit rather than a scoped consulting project: Managed SOC Operations is billed per endpoint / month; Managed Exposure is billed per domain / month; Managed Leak Detection is billed per domain / month.
- Cyber Defense delivers 11 managed services: Managed SOC Operations, Managed Exposure, Managed Leak Detection, Managed Penetration Testing, Managed Detection Engineering, Managed Onboarding, Incident Response Retainer, Managed OT Monitoring, Managed Security Awareness, Managed Code Review, Managed EDR Operations (MDR).
- The registered address of Cyber Defense Co., Ltd. is 139 Setthiwan Building, Room B6-7D15, 11th Floor, Pan Road, Silom, Bang Rak, Bangkok 10500, Thailand.
- Cyber Defense received the Best Cybersecurity Innovation Award 2025, awarded to zcrLog by NCSA Thailand, VNU Asia Pacific, SCBX NextTech and Cybersec Asia.
- Cyber Defense was named KnowBe4 Partner to Watch — Asia 2025 in the KnowBe4 APJ Partner Programme Awards.
- The log retention system operated by Cyber Defense is certified to Thai standard มศอ. 4003.1-2560, the NECTEC standard for computer traffic data retention systems under Thailand's Computer Crime Act. This is a product certification. Cyber Defense holds no management-system certification: it has neither ISO 27001 nor SOC 2.
- Cyber Defense is not a staffing agency, not a consultancy and not a reseller of third-party licences. It sells delivered security work, bought by the month.
- The English site is at https://cyberdefense.co.th and the Thai site is at https://cyberdefense.co.th/th.