Cyber Defense vs CyFlare: two SOC operators, one structural difference
CyFlare is the company on this list that does what we do. Both of us are operators rather than vendors: partners sell, we run the security work behind them, and the end customer never buys from us. Both of us run on a platform we own — Cyflare ONE on their side, zcr on ours. The difference is not the pitch, it is the structure. CyFlare sells the platform and the operator as one thing. We sell them as two, from two companies, and you are allowed to buy only the half you are missing.
- Last checked
- Compared with
- CyFlare
- How we sell
- Only through partners
Where the two models differ
The dimensions that decide which one a partner should buy, including the ones where we come off worse.
| Dimension | Cyber Defense | CyFlare | Edge |
|---|---|---|---|
| Business model | Operator. Partners sell, we deliver under their brand, we never meet the end customer and have no direct sales team that could. | Operator. SOC-as-a-Service for MSPs and MSSPs, split into an MSP tier that runs the platform themselves and a reseller tier they white-label. | EVEN |
| Platform ownership | zcr — eight products we build ourselves and sell under the zcr.ai brand, priced separately from delivery, so you can license the platform without buying our people, or buy our people without moving your platform. | Cyflare ONE, their own platform, sold as part of the package rather than on its own. | OURS |
| Published partner margin | 25%, published. Partners buy at list minus 25%, both columns are on the public price list, and you still set the price your customer pays. | 40%+ margins, stated publicly on their own site — a number a partner can put in a business case before talking to anybody. | THEIRS |
| Working with your existing stack | Managed SOC runs on zcr, so that line does mean telemetry moving there. Managed Detection Engineering is the exception and works against whatever platform you already own. | They state plainly that it works with the tools your practice already runs on, which removes the first objection most partners with a stack will raise. | THEIRS |
| Time zone and language of delivery | Bangkok, UTC+7, delivered in Thai and English. Your customer's working day in Southeast Asia is our working day. | Check their published coverage regions and hours against the market you sell into before assuming either way. | EVEN |
| Fit with Thai regulation | Our log retention system is certified to Thai standard มศอ. 4003.1-2560 (NECTEC) for computer traffic data retention under the Computer Crime Act. | We found nothing published on their own site about Thai traffic data retention. If your customer is audited against it, ask them directly rather than taking our word for it. | OURS |
| Contract shape | One legal counterparty. zcr.ai is this company's platform brand, not a separate company, so both halves are bought from Cyber Defense Co., Ltd. The platform and the operating team are still quoted separately, which is the whole point of the split. | One vendor, one contract, one escalation path. Simpler to run, and the coupling is the price you pay for it. | EVEN |
When you should choose CyFlare instead
If one of these is your situation, take it seriously and buy the other thing. We would rather lose the deal than be the wrong line on your price list.
- Your market's working hours, legal jurisdiction and contracting norms sit a long way from a SOC that runs on UTC+7.
- You cannot move telemetry to another platform. They work with the tools your practice already runs on, and for a partner with an installed stack that is worth more than a lower unit price.
- You want one vendor, one contract and one number to call at 2am, and you would rather trade some flexibility for that.
- You need a published margin figure to build the business case before the first meeting. Theirs is 40%+ and ours is 25%, and on that number they are ahead.
- Your customers ask where their data is processed and the answer has to be somewhere other than Thailand.
What a partner should actually do
If your market sits outside Southeast Asia, CyFlare may well be the better operator for you, and we would rather say so than burn your evaluation cycle. Where we are structurally different is that we refuse to sell the platform and the operator as a single product. zcr.ai will license you the platform and never send you an analyst; Cyber Defense will send you analysts and never ask you to sign for software. A partner who is afraid of lock-in can take exactly the half they are missing and keep the rest of their business intact. Add Bangkok hours, delivery in Thai and มศอ. 4003.1-2560 certification and the case for us is a regional one rather than a universal one — which is the honest way to put it.
Questions partners ask before they commit
Is CyFlare a competitor of Cyber Defense?
CyFlare is the closest competitor Cyber Defense has found: same category, same buyer, same promise that the end customer never sees the operator. The differences are geography and structure, not model.
Can I buy the zcr platform without buying Cyber Defense?
Yes. zcr.ai is this company's platform brand rather than a separate company, but the platform and the operating team are sold as separate products, and you can take the platform and run it with your own analysts. The reverse also holds for most of our catalogue: you can buy penetration testing, detection engineering or an incident response retainer without moving any platform at all.
Do you publish partner margins like CyFlare does?
Yes. Partners buy at list minus 25%, and both columns are published at cyberdefense.co.th/pricing. What we cannot tell you is your actual margin, because we do not set your end-customer price — price above list and the extra is yours as well.
Can you run our SOC on the SIEM we already own?
Cyber Defense cannot run its Managed SOC line on a SIEM you already own, because that line runs on zcr and pretending otherwise would break the economics that make the price what it is. Managed Detection Engineering does work against your platform, and for a partner who must keep an existing SIEM, that is usually the useful line.
Do you sell direct in Thailand?
Cyber Defense does not sell direct in Thailand, and does not sell direct anywhere else either. Every deal closes through a partner, which is also the reason we can promise your customer list will never become our prospect list.