AI at Defense.com

AI Cyber Security: Built In, Not Bolted On

AI at Defense.com isn't a single feature or a chat window stuck on top of your dashboard. It's fundamental to how we help you secure your business. It is built on three pillars: how our platform detects and analyses threats, how you can act on your data through tools like Claude, and how you spot the AI risks your own teams are introducing.

Book a demo See all three in action, on your own data.
A glowing shield seen through a digital targeting scope
01

AI-powered threat detection

Every alert triaged by AI, double-checked, then judged by our UK SOC.

How it works
02

Turn your data into action

Query and act on all your security data through MCP, our API and webhooks.

How it works
03

Spot Shadow AI

See the AI tools your teams use before they become an incident.

How it works
Pillar 01

AI inside Defense.com: detection at machine speed, backed by human judgement

Every alert on the Defense.com platform is triaged by AI before a human ever sees it. Our detection engines process the volume of activity signals no analyst team could keep up with manually. They correlate log events, vulnerability scans and endpoint detections into one prioritised view.

Before it reaches you, our AI output is checked by a second model that grounds its conclusions in your data, to avoid hallucinations or overconfidence where threat context is missing. AI is excellent at qualifying what's good, bad or indifferent at speed. It's less good at long memory, or at the judgement calls that depend on what happened six months ago. That's where people come in.

Behind the AI is a UK-based SOC, staffed 24/7/365. Our analysts review what matters, apply judgement and context, and work alongside your team, so you get machine speed and human accountability rather than one or the other.

Every log event, scan and endpoint detection

AI triages every alertAI triages and prioritises every alert before a human sees it.

Only prioritised alerts move on

A second model checks itIt grounds and verifies the AI Analyst's output, reducing the risk of hallucinated threats.

Only verified threats reach a person

A Defense.com SOC analyst
Our UK SOC applies judgementA UK-based SOC, staffed 24/7/365, adds the judgement, history and context AI doesn't have.

What reaches you: verified, prioritised threats

A Monday morning with AI

Here's what that looks like in practice for a typical IT manager juggling security alongside everything else on their plate.

Example conversations in the AI assistant of your choice, connected through our MCP integration. All data is fictional.

Triaging the week's threats

Your AI assistant, connected to Defense.com through MCP · example

What are our biggest security risks right now?

Ranked by real business impact

How do I fix the top one?

Remediation steps for your environment

Map that to our ISO 27001 controls.

Audit-ready control mapping

Managing the team's workload

Your AI assistant, connected to Defense.com through MCP · example

Show me every threat assigned to Priya.

Priya's workload and risk breakdown

Which threats are over 30 days old and still open?

Ageing open threats

Close the loop automatically

Asking the right question is only useful if an action or remediation follows. Defense.com sends events out through webhooks, and our API lets you read from and write back to the platform, so the AI Analyst doesn't just tell you what to do, it helps make it happen.

You and your AI assistantAsk questions, push in risk registers and audit evidence
API · both waysRead from the platform and write your own data back
Defense.comThreats, compliance and your own data in one place
Webhooks · outFire the moment a threat is detected, updated or closed
Your third-party toolsTickets in Jira, ServiceNow or GitLab, alerts in your chat tool

Bringing your own data in

Your AI assistant, connected to Defense.com through MCP · example

Push our ISO 27001 risk register into Defense.com.

Imported via the API

What evidence do we have for our last ISO 9001 audit, and what's missing?

Evidence held and gaps

[Follow-up prompt]

Pillar 02

One source of truth, fully actionable

Plenty of vendors have bolted an MCP service onto their platform so you can "chat" with your data. That's not really the point, and on its own it doesn't make your security any better. AI works well with Defense.com because you can consolidate the outputs from all your security investments in one place. When you ask a question, the AI Analyst is reasoning across everything, not just one tool's knowledge of the threat.

Defense.com is vendor agnostic, meaning it works with the security tools you already use, so there's no rip-and-replace. Bring your existing data in, and the AI Analyst reasons across all of it.

Bring in what you already have

  • Endpoint and EDR
  • Microsoft 365 and identity
  • Firewalls and network logs
  • Vulnerability scans
  • Risk registers and audit evidence
Defense.com One source of truth

Act on it, your way

MCP integration

Open-source, and connects directly to Claude Desktop or any MCP-compatible client so you can query all of your security threats conversationally.

Claude integration

Ask natural-language questions about your threats, workload and compliance posture, answered using your live Defense.com data.

API access

Build your own workflows and push risk register items, audit tasks or other compliance evidence into Defense.com so the AI Analyst has full context.

Webhooks

Fire an action the moment a threat is detected or closed: raise a ticket, open a GitLab issue or trigger another workflow automatically.

That's the difference between an AI interface and an AI proposition: the conversation doesn't dead-end in a chat window, it turns into action.

See it in action: three incidents, start to finish

Here's how Defense.com supports each stage, from first detection through to response and remediation. Webhooks create, update and close tickets in your own systems at every step, so your team never has to copy details between tools.

Compromised Microsoft 365 account

A phishing email harvests a password and an attacker signs in.

  1. Stage 01 of 07

    Detect

    Anomaly detection spots an unusual sign-in from a new location and correlates it with a new mailbox forwarding rule in Microsoft 365, linking the two events into a single threat.

  2. Stage 02 of 07

    Triage

    AI triage qualifies the threat as a likely account compromise at machine speed. A second model checks that conclusion against your data before it reaches you, with the affected user and activity attached.

  3. Stage 03 of 07

    Notify

    A webhook creates a ticket in your ticketing system or messages your chosen chat tool automatically, while our SOC is already looking at the threat.

    Webhook fires: a ticket is created in your ticketing system
  4. Stage 04 of 07

    Contain

    With Defense.com MDR

    Our 24/7/365 UK SOC revokes the account's sessions and locks the account to stop further access.

    Managing it yourself

    You get step-by-step containment actions for your team and partners.

  5. Stage 05 of 07

    Investigate

    Through MCP, ask Claude what else the account touched, which mailboxes were accessed and whether other users received the same email, with answers drawn from your live data.

  6. Stage 06 of 07

    Remediate

    Tailored guidance to reset credentials, remove the forwarding rule and re-enrol MFA. Webhooks keep you updated as each step completes.

    Webhook fires: your ticket is updated with progress
  7. Stage 07 of 07

    Close and learn

    The ticket closes and the incident is mapped to your compliance obligations. Security Awareness Training can turn the phishing email into next week's training.

    Webhook fires: your ticket is closed automatically
Stage
Webhooks

Ransomware on an endpoint

Malicious behaviour starts encrypting files on a laptop.

  1. Stage 01 of 07

    Detect

    Endpoint Protection flags ransomware behaviour on a single device, stops it immediately and passes the alert into the platform.

  2. Stage 02 of 07

    Triage

    AI triage correlates the alert with log data to check whether other devices or accounts are involved, and prioritises it as critical.

  3. Stage 03 of 07

    Notify

    A webhook raises a critical ticket in your system, so nobody has to spot the alert and raise it manually.

    Webhook fires: a ticket is created in your ticketing system
  4. Stage 04 of 07

    Contain

    With Defense.com MDR

    Our SOC isolates the endpoint from the network to stop the spread.

    Managing it yourself

    You get clear isolation instructions, step by step.

  5. Stage 05 of 07

    Scope

    Through MCP, ask Claude whether the file hash and behaviour have been seen on any other device, and what our built-in threat intelligence says about it.

  6. Stage 06 of 07

    Remediate

    Step-by-step guidance to clean or rebuild the device and close the entry point.

    Webhook fires: your ticket is updated with progress
  7. Stage 07 of 07

    Close and report

    The threat is mapped to your compliance obligations so you know whether it's reportable, with a plain-English summary for leadership.

    Webhook fires: your ticket is closed automatically
Stage
Webhooks

Critical vulnerability on an internet-facing system

A newly published flaw affects a server exposed to the internet.

  1. Stage 01 of 06

    Detect

    Vulnerability scanning and Threat Recon find a critical vulnerability on a public-facing server as soon as the scan completes.

  2. Stage 02 of 06

    Prioritise

    AI ranks it above hundreds of other findings on real business risk, because the system is exposed and the flaw is critical, not just on severity score.

  3. Stage 03 of 06

    Assign

    A webhook opens a ticket in your system, ready to assign to the right engineer.

    Webhook fires: a ticket is created in your ticketing system
  4. Stage 04 of 06

    Remediate

    Tailored remediation guidance, in the platform or by asking Claude, so the engineer can patch with confidence.

  5. Stage 05 of 06

    Verify

    A rescan confirms the fix. The threat closes in Defense.com and a webhook closes the ticket.

    Webhook fires: your ticket is closed automatically
  6. Stage 06 of 06

    Report

    The fix appears in your leadership update, with remediation speed tracked over time and mapped to ISO 27001 and other frameworks.

Stage
Webhooks

Turn AI insight into exec-level reporting

Proving security ROI to a leadership team is usually a slide-deck exercise bolted onto everyone's real job. With Defense.com, the reporting comes from the same questions you're already asking day to day.

That's board-ready evidence that your investment in Defense.com is reducing risk and saving the cost of a bigger team, without you building the deck by hand.

An IT manager talks two colleagues through a one-page security summary in a meeting room

Building your next leadership update

Your AI assistant, connected to Defense.com through MCP · example

Summarise this quarter's threat activity and how we responded.

Volume, severity and resolution

How has our average time-to-remediate changed over the last month?

Time-to-remediate trend

What's our current compliance readiness score against ISO 27001 and GDPR?

Readiness scores

Turn this into a one-page summary for the board.

Board summary, in business language

Prove compliance, including AI governance

Our Cyber Assessment is a compliance readiness questionnaire covering ISO 27001, GDPR, NIST and PCI DSS, and now ISO 42001, the international standard for AI management systems. As AI becomes part of how you work, ISO 42001 gives you and your customers a recognised way to show that AI use across your business is well governed, not just well intentioned.

  • ISO 27001
  • GDPR
  • NIST
  • PCI DSS
  • New ISO 42001 AI management systems
Pillar 03

Spot Shadow AI before it becomes your next incident

Your team is already using AI: Copilot, Claude, Gemini, and plenty of tools nobody signed off. That's the newest insider-risk problem IT teams face, and Defense.com helps you see it using capability you may already have switched on.

It's not a bolt-on Shadow AI product. It's the same platform and the same AI Analyst, looking at one more kind of risk.

Unsanctioned tools, on every device

Endpoint Protection and our Orbital Agent already track installed applications on every device, including unsanctioned AI tools and browser extensions nobody approved.

Risky usage, in the same view

Feed usage logs from your sanctioned AI platforms into Defense.com via the API, and unusual or risky patterns surface in the same AI Analyst view as everything else, with no separate dashboard to check.

Shadow AI data leak

An employee pastes sensitive customer data into an AI tool nobody approved.

  1. Stage 01 of 07

    Detect

    Endpoint Protection and the endpoint agent show an unapproved AI application on a device, while log data shows unusual volumes of data going to an AI service.

  2. Stage 02 of 07

    Triage

    AI triage assesses the risk: which user, which device, and what kind of data may have left.

  3. Stage 03 of 07

    Notify

    A webhook creates a ticket in your system automatically.

    Webhook fires: a ticket is created in your ticketing system
  4. Stage 04 of 07

    Contain

    With Defense.com MDR

    Our SOC restricts the device or suspends the account while you establish what was shared.

    Managing it yourself

    You get clear containment steps.

  5. Stage 05 of 07

    Scope

    Through MCP, ask which other devices have the same tool and who else has been using it.

  6. Stage 06 of 07

    Remediate

    The tool is removed or replaced with an approved alternative, and Security Awareness Training, which now covers AI and LLM risks, retrains staff on safe AI use.

  7. Stage 07 of 07

    Close and govern

    The ticket closes, and the Cyber Assessment, which now includes ISO 42001, tracks the gap against your AI governance requirements.

    Webhook fires: your ticket is closed automatically
Stage
Webhooks
A small team gathers round a laptop during a security awareness training session

Train your team on the AI risks you can't automate away

Technology can show you where AI is being used, but it can't make sure your people use it safely. Our Security Awareness Training now covers AI and LLM-specific risks, including unsanctioned ("shadow") AI use, data leakage into AI tools and prompt injection, alongside the phishing simulations and core awareness content your team already relies on.

  • Shadow AI use

    Spotting and avoiding AI tools nobody has approved.

    New

  • Data leakage into AI

    What should never be pasted into an AI tool.

    New

  • Prompt injection

    How hidden instructions can hijack an AI tool.

    New

  • Phishing simulations

    Realistic tests that keep everyday awareness sharp.

    Core

See it on your own environment

The fastest way to understand what AI can do for your security operations is to ask it a question. Book a demo and we'll show you, live, using real threat data.

Book a demo

Frequently asked questions

MCP (Model Context Protocol) is an open standard, developed by Anthropic, that lets AI models securely connect to external data sources. Defense.com uses it so AI assistants like Claude can query your live threat data directly, instead of relying on static reports or manual exports. Our MCP integration is open-source.

Yes. Connect Defense.com to Claude Desktop or any MCP-compatible AI client, and you can ask natural-language questions about your threats, workload and compliance status, answered using your live Defense.com data.

Yes. Webhooks let you fire an action out of Defense.com the moment a threat is detected or resolved, such as opening a ticket in Jira, ServiceNow or GitLab, or triggering another workflow of your choice.

Yes, via our API. Many customers use it to bring in risk register items, audit tasks or other compliance evidence, so it sits alongside security threats and the AI Analyst has full context when answering questions.

The AI Analyst's output is checked by a second model that grounds its conclusions in your actual data, reducing the risk of hallucinated advice. Our UK-based SOC and your own team still review it and apply the judgement AI doesn't have.

No. Defense.com is vendor agnostic and works with the tools you already have, so there's no rip-and-replace. Data from your existing tools comes into one platform, which is what lets the AI Analyst reason across everything.

Shadow AI is the unsanctioned use of AI tools across your business, from browser-based chatbots to AI features inside everyday apps. Our Endpoint Protection and Orbital Agent can flag unapproved AI software on devices, and usage logs from your sanctioned AI tools can be fed into Defense.com via the API to surface risky patterns.

No. The AI tools, Claude integration and webhooks are designed to be set up and used without code. Our API is there if your developers want to build custom integrations on top of Defense.com data.

Our Cyber Assessment now includes ISO 42001 alongside ISO 27001, GDPR, NIST and PCI DSS, helping you benchmark and evidence how AI is governed across your business.