Cyber Defense vs Stellar Cyber: a platform to run, or people to run it
Stellar Cyber is the closest thing in this market to the platform we build ourselves and sell as zcr: a multi-tenant Open XDR and AI-SIEM aimed squarely at MSSPs, licensed once to cover multiple tiers, tenants and sites. So the first thing to settle is which half you are shopping for. If it is the platform, the like-for-like fight is Stellar Cyber against zcr, and that is a product comparison, not a services one. This page is the other half. We do not only sell a platform for you to run; we are the people who run one for you, under your name, so that a partner with customers but no analysts can still sell managed security.
- Last checked
- Compared with
- Stellar Cyber
- How we sell
- Only through partners
Where the two models differ
The dimensions that decide which one a partner should buy, including the ones where we come off worse.
| Dimension | Cyber Defense | Stellar Cyber | Edge |
|---|---|---|---|
| Which half you are buying | The people half. Analysts on shift, working cases against a documented methodology, invisible to your customer. | The platform half. Software your own team logs into and operates. | EVEN |
| Who staffs the console | We do. No hiring, no shift roster, no attrition problem on your side. | You do. Stellar Cyber sells the platform; recruiting, rostering and retention stay with you. | OURS |
| Multi-tenancy | We operate on zcr, multi-tenant by design and built in-house — which is why one detection rule can run a single query across every tenant we watch. | Multi-tier, multi-tenant, multi-site on a single licence. It is their headline architecture and the thing the whole platform is built around. | THEIRS |
| Network detection | We work whatever telemetry reaches the tenant. Network sensors are not a product we make. | NDR sits inside the platform alongside Open XDR and AI-SIEM rather than being fed in from a third party. | THEIRS |
| Published prices | A monthly unit per service, published in full at cyberdefense.co.th/pricing — list price, partner price and the 25% partner margin. | Not published, as of our check on 4 September 2026. Their pricing route ends at a conversation with sales. | EVEN |
| Lead flow back to partners | No directory. We also never meet an end customer, so there is no mechanism by which we could keep a lead even if one arrived. | A public Find an MSSP directory that hands end customers to their partners — channel commitment proved by an action rather than a sentence. | THEIRS |
| Buying the halves separately | One company, two products, two prices — the zcr platform and the operating team. You can take either one without the other. | One vendor, one platform, one licence. The operating team is not part of the offer and was never meant to be. | OURS |
When you should choose Stellar Cyber instead
If one of these is your situation, take it seriously and buy the other thing. We would rather lose the deal than be the wrong line on your price list.
- You already employ analysts and the only gap is a multi-tenant platform for them to work in. At that point you are shopping for a platform. Stellar Cyber is a serious one — so is zcr, which this same company sells, and either way that is a product decision rather than a reason to buy delivery from us.
- Your procurement or your customers need an established platform vendor they can look up independently, which in some deals matters more than the technology.
- Network detection is central to your service and you want NDR inside the same licence instead of stitched in from elsewhere.
- You intend to own the whole delivery yourself and do not want an outside operator anywhere in the escalation path — a defensible strategy, and one we are structurally unable to serve.
- Partner-directed lead flow is part of your business case. Their Find an MSSP directory is a genuine channel benefit and we have no equivalent.
What a partner should actually do
If you are comparing platforms, the like-for-like fight is Stellar Cyber against zcr, and we would rather say so than dress a platform comparison up as a services one. Cyber Defense enters the picture when the platform is not the problem. A partner with three analysts and no tooling should buy a platform. A partner with twelve customers, a full pipeline and nobody to work a case at 2am cannot buy their way out of that with software, however good the multi-tenancy is. If you are the second kind of partner, take zcr for the platform and us for the shift, and keep your own name on both.
Questions partners ask before they commit
Is Cyber Defense a Stellar Cyber competitor?
Not on the services side, which is what this site sells. Stellar Cyber sells software to MSSPs who operate it themselves; every line on our price list is people rather than licences. The product-for-product comparison you are probably looking for is Stellar Cyber against zcr — the platform the same company builds, sold separately at zcr.ai.
Can you run our SOC on Stellar Cyber, or on the SIEM we already own?
Our managed SOC runs on zcr — that is where the unit economics come from, and it is the honest limit of the service. Managed Detection Engineering is different: it delivers rules, parsers and tuning as reviewed code for the platform you already run, whatever that platform is.
What is zcr.ai and how is it related to you?
zcr.ai is our own platform brand, not a separate company: eight products, from zcrLog and zcrSIEM through to zcrCTEM and zcrOT, all built by Cyber Defense Co., Ltd., which is the single legal entity behind both names. Two brands on purpose, so a partner can license the platform without buying our people, or buy our people without touching the platform.
Which one is cheaper?
Our rates are published at cyberdefense.co.th/pricing; Stellar Cyber's are not, so anyone who gives you a like-for-like number is guessing at their half of it. What can be compared is the shape: a platform licence is a fixed cost you carry whether or not the console is staffed, while our unit is per customer per month and the staffing is already inside it.
Is multi-tenancy really the deciding factor?
It decides whether your cost per customer falls as you grow, which is the whole economics of managed security. It does not decide whether the queue gets worked. Partners who confuse the two buy excellent platforms and then discover the alerts are still nobody's job.