Skip to main content
This page is the conceptual map. Read it once and the rest of the docs make sense. It applies to every ThreatAware plan.

​
60 second walkthrough

​
How it works

1

Connect your tools

ThreatAware connects to the tools you already have, such as CrowdStrike, Intune, Active Directory, Jamf and Qualys, using read-only API access. There are no agents to install. It pulls fresh data every hour, and on-premises tools are reached through the PowerShell Relay. See Integrations.
2

Match every report to one device

One laptop can show up in five tools under slightly different names. ThreatAware matches those reports by serial number, machine name, MAC address, user and timeline, and merges them into one record per device. No tool is treated as the source of truth, so a device that appears in any of them appears in ThreatAware.
3

Check your controls

Vitals check every security control on every device in three stages: is it deployed, is it working, and is it configured the way your policy says? Anything that fails becomes an Issue. Discover and Protect.
4

Get gaps fixed

Tracked Views follow the devices that need fixing until each one is resolved, and Action Center alerts the right people or raises tickets automatically. ThreatAware.

​
Why you can trust the data

Because ThreatAware compares every tool against the others, it catches what a single console can’t. The classic example is a silent failure: CrowdStrike still lists the agent as installed, but Intune shows the device online every day while CrowdStrike hasn’t heard from it in weeks. The agent is broken, not the device. Discover and Protect. To check any value yourself, open X-Ray on a device. It shows exactly what each tool reported and when, which is also what you show an auditor who asks you to prove it.

​
Finding your way around

  • Dashboard: your estate and control health at a glance
  • Device Explorer: a live map of your estate and each integration’s sync status
  • Devices: every device, with filters, saved views and Vitals
  • Users and Software Inventory: who uses each device and what runs on it (Protect)
  • Issues: every failing control, device by device (Discover and Protect)
  • Action Center: flows that alert people and raise tickets (Protect)
  • Reporting: your own reports and dashboards, with pinned apps just below
  • Settings: integrations, users, roles and more, at the bottom of the rail
  • Command Menu: press ⌘ K (Ctrl K on Windows) to get anywhere fast

​
Plans

ThreatAware comes in three plans: Connect, Discover and Protect, our top tier. Each includes everything in the plan before it, and each page in these docs shows which plans it covers.
For the full feature comparison, see Compare plans on our website.

​
Security in brief

Read-only API access. ThreatAware never changes anything in your tools. On Protect, Action Center flows can send emails and requests that you set up.
Encrypted in transit (TLS 1.2+) and at rest (AES-256)
ISO 27001 certified, Cyber Essentials certified, GDPR compliant
UK data residency by default; other regions on request
No agents to deploy or patch on your devices
Full detail in Trust & Security.