UnderDefense Reviews

My main use case for UnderDefense is threat detection and triage, but I use UnderDefense Agentic AI SOC to monitor my infrastructure, seeing constant background noise and sudden traffic jumps, treating signals in context across my stack. I have a rich stack, so I need it to monitor documents and routine activity. It is very precise and brings only the cases that need human decisions to my team.

A quick specific example of how UnderDefense has helped me catch something unusual or prevented a threat is in the area that I work. I care about privacy and abuse control, and as for URLizer, it is all about abuse and threat control because I allow creating links for anonymous users, which can damage my domain reputation and my infrastructure and resources connected to it. It is specifically useful during large customer events, and UnderDefense helps a lot.

That is the main reason I use UnderDefense, but it of course has some different integrations with different sites of infrastructure such as Amazon Web Services or Slack.

UnderDefense Agentic AI SOC connects to our existing stack, including AWS and Slack, and works on top of it.

UnderDefense has positively impacted my organization as my security work is calmer and more focused. Routine signals are handled and documented, and only cases that need a human decision reach my team, allowing engineers to spend their time on infrastructure hardening instead of log digging.

This change has significantly affected productivity and efficiency. For example, one case I still remember vividly is when I had a bot signups spike. It helped me recognize and even suggested a solution. I added a honeypot to the sign-up form because I do not want to add the CAPTCHA and human check to the sign-up, as I do not want to share IP addresses with third-party services, which led me to invent something new.

The best features UnderDefense offers include mostly triage in-context signals read together across my stack, where one finding replaces many separate checks. A good thing too is its false positive suppression, as I do not get false notifications. Normal activity such as traffic spikes during customer events is recognized and documented, and only the unusual cases reach me. It has full-time support 24/7 with proactive reports, and monitoring runs around the clock. Reports and alerts come to me without even noticing or asking, so it is very useful. My team sees what happened without having to chase it.

I find the proactive reporting and 24/7 support to have definitely made a real difference. Proactive reports mean I hear about what happened without having to ask, so I know the state of things at the start of the day, and 24/7 support matters most for traffic spikes and other events outside busy working hours, as I get an answer when I need one without keeping someone on call just in case, saving me a lot of time. Together, they let my team stay on infrastructure work and step in only when a decision is needed.

Regarding UnderDefense's AI capabilities, I think the governance and security is the best there is, as the decisions that matter stay with my team and each finding is documented, allowing me to review afterwards how a conclusion was reached. That control and traceability is what I need from AI in a security role.

The accuracy and reliability of UnderDefense's AI output is accurate and steady, as findings have matched what I saw when I checked them, and the pattern assessments are consistent, especially during large traffic events or spikes, which is when I depend on them most. When a case needs judgment, the reasoning is there so I can confirm it myself.

UnderDefense is very good and very solid as it is right now, and I cannot even imagine what can be improved. It is good on its own. Everything seems to be great, and I have no objections.

I have been using UnderDefense for about three years.

UnderDefense is 100% stable.

UnderDefense's scalability is good, and I have no objections.

The customer support is at a high level, as usual. I would rate the customer support on a scale of 1 to 10 as 10.

I have not previously used a different solution.

I have seen a return on investment, which was the goal to save on the team and save on employment needs.

My experience with pricing, setup cost, and licensing was that pricing was fair for what I get, the setup was easy and cost me very little time, and licensing was clear from the start, giving me good value for the price.

Before choosing UnderDefense, I did not evaluate other options, as it fitted me straight from the start.

On a scale of 1 to 10, I would rate UnderDefense overall as 10, the highest one. I chose 10 as my rating mostly because of what it did not do. It did not force me to dig into technicalities, to search for something, or to waste my time. My recommendation to others reading reviews on PeerSpot is to not hesitate. UnderDefense knows what they are doing. They are the best, so trust them.

My main use case for UnderDefense is to watch our published data endpoints using UnderDefense Agentic AI SOC. Customers connect through OData, ODBC, and MCP for AI agents, and it tells us when the use of an endpoint stops looking normal.

A specific example of how UnderDefense helped us identify something unusual occurred when an AI agent connected through our MCP endpoint and started scanning every table and downloading data page by page. Each request was allowed, but the volume was the problem. UnderDefense grouped it into one alert with the caller. With the caller, the endpoint, and the usual pattern, we contacted the customer the same day. They updated their agent, fixed it, and we kept data limits per session.

UnderDefense also helps us tell normal teamwork apart from scraping, which is important for us since our traffic is high each day. Each alert names the user, the endpoint, and the queries with the reasoning attached.

UnderDefense positively impacts my organization by allowing us to offer live data endpoints, including MCP for AI agents, because someone is watching how they are used. When a pattern breaks, we can tell the customer what happened with facts in hand, and our engineers stay on the platform itself.

This positive impact shows up in my daily work and my team's workflow by mostly saving us time and helping customer trust. Each alert comes with the caller, the endpoint, and the queries, so we do not need to dig through logs to find them. When something looks wrong, we can reach the customer the same day and show them what happens, which makes the conversation shorter and builds trust, so I do not have to extract numbers to share.

The best features UnderDefense offers are three standouts: anomaly detection, which links queries into the finding and shows when usage breaks the usual pattern; noise filtering, which recognizes normal traffic so only unusual cases reach us; and clear reasoning, where each alert names the user, the endpoint, and the queries and explains why it was flagged.

The anomaly detection feature makes our job easier in one clear way, as each query on its own looks fine, so we cannot spot problems by checking single requests. UnderDefense looks at the whole sequence and shows when it breaks the usual pattern by giving us one finding with the caller, the endpoint, and the reasoning.

These features work well together, which is why we can keep our endpoints open to customers.

Nothing major stands out to improve UnderDefense. One small wish is that alerts show our internal identifiers so we can match them to the customer name before reaching out, as it currently takes a minute or two. Showing the customer name directly in the alert would really help, as the account team could contact the right customer right away, which matters most on busy days when our traffic is high. Everything else has worked the way we hoped, so I have nothing more to suggest at this point.     

I have been using UnderDefense for less than one year.

UnderDefense has been stable. We use it every day and it has run steadily, including when our traffic is high.

The scalability of UnderDefense is good. Our traffic is high, and UnderDefense handles it without us changing anything. As our endpoints and customers grow, the same coverage applies, so we expect it to keep up.

The customer support has been responsive and helpful. When we needed an alert explained, we got a clear answer quickly.

I would rate the customer support a 10 on a scale of 1 to 10.

I have seen a return on investment mostly in time. Each alert comes with the caller, the endpoint, and the queries, so we do not dig through logs. Our engineers stay on the platform itself, allowing us to keep our endpoints open to customers. I do not have exact numbers to share, but one example is the MCP agent case, where we reached the customer the same day with facts in hand.

My experience with pricing, setup cost, and licensing is that the pricing is fair for what we get. Setup is simple, and the licensing was clear from the start. We see good value for the price.

I would rate UnderDefense a 10 overall.

I choose 10 as my rating because it does what we need every day. It tells us when an endpoint looks wrong with clear reasoning, which helps us keep our endpoints open to customers. The only change I would make is minor, which is showing the customer name in the alert.

UnderDefense's governance and security are good, as the decisions stay with my team. Each alert shows its reasoning, so we can check how a conclusion was reached. That control and clear record are what we need from an AI in a security role.

The accuracy and reliability of UnderDefense's output are accurate and steady. When we check alerts against our own logs, they match. Quality stays in the same form day-to-day, even when traffic is high. In cases that need judgment, the reasoning is there, so we can confirm it ourselves.

UnderDefense is deployed in my organization in a public cloud. Our platform runs in the cloud, and UnderDefense connects to it there.

We use Microsoft Azure as our cloud provider, and our platform runs on Azure while UnderDefense connects to it there.

My advice to others looking into using UnderDefense is to tell them early what normal use looks like for your endpoints, including your busiest times. This way, it can distinguish real problems from busy days, and you will get fewer false alarms.

UnderDefense serves as our primary tool to monitor the platform that carries our customer's media and asset pipelines. When upload spikes or an asset spreads fast, UnderDefense pulls cloud storage, identity, and endpoint activity into one finding, allowing us to quickly determine whether activity is authorized and whether there is a leak risk. The decision stays with our team.

Recently, a large bulk upload from one customer was followed by downloads of the original files from a protected collection using a sign-in that did not match that customer's usual pattern. On their own, both steps looked like normal campaign activity. UnderDefense linked them into one finding, checked against who was authorized, and showed why this one did not fit. We confirmed with the customer, revoked the session, and rotated the sharing links of that collection. Nothing was left beyond that one account.

The finding came with the reasoning and the sources it was based on. I could forward it as it was to the customer's contact and to our own team. That made the conversation with the customer short because we could show what happened and in what order instead of describing it from memory. It also meant we were not waiting on one person to explain an alert before acting.

UnderDefense has had a positive impact on my organization mainly through saving time. Log triage used to take a large share of our security team's calendar, but UnderDefense Agentic AI SOC now does the context gathering, first validation, and case documentation. This frees our specialists to work on platform architecture, our custom DRM protections, and proactive hardening, and it gives us a more consistent way of handling alerts since every case arrives with the same sources and reasoning attached. The decisions still sit with our team, allowing us to make them faster.

Investigations that used to mean pulling data from several consoles now start from one finding with the sources attached, and log triage no longer takes up our security team's calendar. That time now goes into platform architecture, our DRM protections, and proactive hardening, and the same team handles the volume our platform produces.

Three features stand out for UnderDefense. Linking activity across sources allows cloud storage, identity, and endpoint events to come together as one finding, so we see the whole chain of a possible leak in one place. Noise filtering and triage recognize routine spikes from bulk uploads or fast-spreading assets as normal, and only then do unusual cases reach us, ranked by risk. The reasoning we can read shows what each finding was based on and why it was flagged, and a second agent checks the verdict before it comes to us, allowing us to act on it with confidence.

The noise filtering for our team works well in both cutting down on alerts and making our investigations easier. Our platform produces a lot of routine activity, such as bulk uploads and assets that spread quickly, and UnderDefense recognizes those patterns as normal, so most of it never reaches us. The alerts that do come are already ranked by risk and arrive with the related events and sources attached. Before, time went into pulling those pieces together from several consoles by hand; now we open one finding and start from the answer, reducing the effort needed for investigations.

The features work as a set. The linking, the filtering, and the readable reasoning each help on their own, but together, they allow a small security team to handle the volume our platform produces without losing sight of the cases that matter.

Regarding UnderDefense's AI capabilities, I find its governance and security to be good. The decisions stay with our team, and each finding shows its sources and reasoning with a second agent checking the verdict before it reaches us. Every case is documented, allowing us to review afterward how a conclusion was reached. That control and traceability is what we needed from an AI in a security role.

In terms of accuracy and reliability of output, UnderDefense is accurate and steady. Findings have held up when we check them against the sources, and a second agent reviews each verdict before it reaches us. It is consistent during traffic spikes, which is when we depend on it most, and when a case needs a judgment, we see the reasoning to confirm or overrule it.

UnderDefense could improve in onboarding, which takes some dedicated time because the baseline for our high volume upload events needs to be set up first. It is worth it for accurate triage later, but a template for common upload patterns will shorten that time.

The onboarding point mentioned is the main area for improvement, and everything else has worked the way we hoped.

I have been using UnderDefense for less than one year.

UnderDefense is stable.

The scalability of UnderDefense is good. Our platform sees sharp spikes from bulk uploads and fast-spreading assets, and UnderDefense Agentic AI SOC handles them without needing us to resize or retune anything. The same coverage applies as the volume of events grows, so we expect it to keep up with what we do.

The customer support has been responsive and helpful from the start. When we needed a baseline adjusted or a finding explained, we got a clear answer quickly.

We have seen a return on investment mainly in time. Log triage no longer takes up our security team's calendar, allowing those hours to go into platform architecture, our DRM protections, and proactive hardening. We did not have to hire additional analysts to cover this, and the value shows up in the work our team now has room to do.

The experience with pricing, setup cost, and licensing has been fair for what we get. Compared with building the same coverage in-house, it is a much lower cost and did not require us to hire. The setup cost was mostly our own team's time spent on setting the baseline for our high volume upload events, and the licensing was clear from the start. Overall, we see good value for the price.

UnderDefense deserves a rating of 10 because it does what we need, and it does it consistently. Our team spends its time on decision-making instead of log triage, and the findings come with the sources and reasoning attached. The only thing we would change is the onboarding effort, which is small compared to the benefit.

UnderDefense is deployed in our organization as a public cloud solution. Our platform and the sources we monitor, such as cloud storage and identity providers, are cloud-based, and UnderDefense connects to them there.

We use AWS as our cloud provider.

Our advice to others looking into using UnderDefense is to set aside time during onboarding to define what normal looks like for your own traffic, because that baseline is what makes the triage accurate afterward.

My main use case for UnderDefense is to rely on UnderDefense Agentic AI SOC to watch our cloud environment around the clock, as it reads signals across our stack, which includes AWS and Cloudflare.

An example of a situation where UnderDefense's AI SOC helped my team is when a storage bucket's access setting was widened during a routine deployment, and soon after, reads started arriving from an address range we had never seen. Each event alone looked ordinary, but UnderDefense linked them in one finding and explained why they matter together, allowing us to confirm that the change was a mistake and close the access the same day.

UnderDefense has positively impacted my organization by providing clear cloud security coverage without building a big security team ourselves, as routine alerts no longer take up our engineers' time, allowing them to stay focused on the product.

What changed is how the team spends its time, as we did not have to hire a security team to get 24/7 coverage, and routine alerts no longer take up our engineers' week, so that time goes into the product.

The best features UnderDefense offers include sorting signals, which tell routine activity from real problems, cutting false alarms, where normal activity gets recognized, reducing pointless alerts, and clear reports, as each case comes with the full picture, allowing us to know what happened and what to do.

The sorting signals and clear reports help my team day-to-day because every morning we look at a short list of cases that matter instead of a long list of raw alerts, and each case comes with the full picture, so we can decide in a few minutes whether it needs action. For example, a change in our cloud settings shows up with what changed and who it affects, so we do not have to dig through logs to find out.

Regarding UnderDefense's AI capabilities, I believe that its governance and security ensure the decisions that matter stay with our team, and every case is documented so we can see afterwards how a conclusion was reached, providing us with the control and clear record we need from an AI in a security role.

UnderDefense's accuracy and reliability of output are accurate and steady. When we check findings against what we see in our environment, they match, and the quality stays the same from one day to the next, with explanations available when a case needs judgment so we can confirm it ourselves.

UnderDefense has worked well for us, and the setup and daily use have both been smooth. I have nothing major to suggest at the moment for improvements.

I have been using UnderDefense for less than a year.

UnderDefense is stable.

UnderDefense's scalability is good, as the same coverage applies as our cloud environment grows without us changing anything on our side, so we expect it to keep up as we do.

The customer support is perfect, and I would rate the customer support a 10.

I have seen a return on investment, mainly in time and not having to build a team, as we did not need to hire a security team to get around-the-clock cloud coverage, and routine alerts no longer take up our engineers' week, allowing that time to be allocated to the product.

Pricing was fair for what we get, setup was easy and took very little of our time, and the licensing was clear from the start, enabling us to see good value for the price.

I would rate UnderDefense a 10. I chose this rating because it does what we need it to do, and it does it reliably. We get clear cloud security coverage, routine alerts no longer take up our engineers' time, and both the setup and daily use have been smooth, leaving us with no reason to take points off.

UnderDefense is deployed in our organization as public cloud, as our infrastructure is on AWS with Cloudflare.

My advice for others looking into using UnderDefense is to connect it to your cloud environment early so it learns what normal looks like for you, and then let it sort the routine activity to keep your team's time for the cases that need a decision.

Our main use case for UnderDefense Agentic AI SOC is to watch how accounts actually use our platform. Our product is a large database of creator data that customers search and export, so the biggest risk we carry is someone turning a legitimate account into a pipeline for bulk extraction. We rely on it most for catching that early: a sign-in pattern that does not match how the account normally works, an export volume that jumps past what a real campaign would need, or usage that ramps in a way no genuine customer does. That is the part we count on day to day, and it protects the data set itself, which is what customers pay for.

An example of how it catches something suspicious is when it flags behavior that breaks from an account's own baseline. For us, that looks like an export volume several times higher than the account's normal range in a single session, or a sign-in from a new location right before a large batch pull of creator profiles. When that happens, the alert already lays out which signals triggered it and why it reads as different from normal agency activity. Our team can look at the account and decide whether it is a big campaign push or a compromised login, usually the same day.

The alerts land in the channel our engineers already watch, so there is no separate tool to check. Most days there is nothing, and when something does come through, it is usually one of us on the account team who looks first, since we know which clients run big legitimate batches around launches. If it still looks off, we loop in engineering. It has become part of how we trust the exports feature enough to keep it open for agencies.

I have been using UnderDefense for approximately one year.