> ## Documentation Index > Fetch the complete documentation index at: https://docs.threataware.com/llms.txt > Use this file to discover all available pages before exploring further. # How ThreatAware works > How ThreatAware collects, deduplicates, and surfaces device data, what each plan adds, and the shape of the UI you'll work in every day This page is the conceptual map. Read it once and the rest of the docs make sense. It applies to every ThreatAware plan. ## 60 second walkthrough [ThreatAware platform walkthrough](https://app.getreprise.com/present/7nkg4wn) ## How it works **1. Connect your tools** ThreatAware connects to the tools you already have, such as CrowdStrike, Intune, Active Directory, Jamf and Qualys, using read-only API access. There are no agents to install. It pulls fresh data every hour, and on-premises tools are reached through the [PowerShell Relay](https://docs.threataware.com/powershell-relay.md). See [Integrations](https://docs.threataware.com/integrations.md). **2. Match every report to one device** One laptop can show up in five tools under slightly different names. ThreatAware matches those reports by serial number, machine name, MAC address, user and timeline, and merges them into one record per device. No tool is treated as the source of truth, so a device that appears in any of them appears in ThreatAware. **3. Check your controls** [Vitals](https://docs.threataware.com/security-monitoring.md) check every security control on every device in three stages: is it **deployed**, is it **working**, and is it **configured** the way your policy says? Anything that fails becomes an [Issue](https://docs.threataware.com/issues.md). *Discover and Protect.* **4. Get gaps fixed** [Tracked Views](https://docs.threataware.com/tracked-views.md) follow the devices that need fixing until each one is resolved, and [Action Center](https://docs.threataware.com/automation.md) alerts the right people or raises tickets automatically. *ThreatAware.* ## Why you can trust the data Because ThreatAware compares every tool against the others, it catches what a single console can't. The classic example is a **silent failure**: CrowdStrike still lists the agent as installed, but Intune shows the device online every day while CrowdStrike hasn't heard from it in weeks. The agent is broken, not the device. *Discover and Protect.* To check any value yourself, open [X-Ray](https://docs.threataware.com/x-ray.md) on a device. It shows exactly what each tool reported and when, which is also what you show an auditor who asks you to prove it. ## Finding your way around [Finding your way around ThreatAware](https://app.getreprise.com/present/E63ZbJy) > **Jump into the docs to deep dive into each section** > > * **[Dashboard](https://docs.threataware.com/dashboard.md):** your estate and control health at a glance > * **[Device Explorer](https://docs.threataware.com/device-explorer.md):** a live map of your estate and each integration's sync status > * **[Devices](https://docs.threataware.com/device-management.md):** every device, with filters, saved views and Vitals > * **[Users](https://docs.threataware.com/user-inventory.md)** and **[Software Inventory](https://docs.threataware.com/software-inventory.md):** who uses each device and what runs on it *(Protect)* > * **[Issues](https://docs.threataware.com/issues.md):** every failing control, device by device *(Discover and Protect)* > * **[Action Center](https://docs.threataware.com/automation.md):** flows that alert people and raise tickets *(Protect)* > * **[Reporting](https://docs.threataware.com/reporting.md):** your own reports and dashboards, with pinned apps just below > * **[Settings](https://docs.threataware.com/settings.md):** integrations, users, roles and more, at the bottom of the rail > * **[Command Menu](https://docs.threataware.com/reference/keyboard-shortcuts.md#command-menu):** press ⌘ K (Ctrl K on Windows) to get anywhere fast ## Plans ThreatAware comes in three plans: **Connect**, **Discover** and **Protect**, our top tier. Each includes everything in the plan before it, and each page in these docs shows which plans it covers. > **What each plan adds** > > | Plan | The question it answers | What it adds | > | - | - | - | > | **Connect** | What have I got? | A complete, hourly-refreshed inventory of every device from every tool you already own, with [Device Explorer](https://docs.threataware.com/device-explorer.md), [tags](https://docs.threataware.com/tags.md), saved views, exports and scheduled reports. | > | **Discover** | Are my security tools working? | [Vitals](https://docs.threataware.com/security-monitoring.md), which check that every security agent is working and configured correctly, plus [Issues](https://docs.threataware.com/issues.md), [X-Ray](https://docs.threataware.com/x-ray.md), the Control Health dashboard, advanced search and the [Logic Engine](https://docs.threataware.com/logic-engine.md). | > | **Protect** | Get it fixed, and prove it. | Our top tier. Everything in Discover, plus [Custom Vitals](https://docs.threataware.com/vitals-configuration.md#custom-vitals) to write your own compliance checks, [Tracked Views](https://docs.threataware.com/tracked-views.md) and [Action Center](https://docs.threataware.com/automation.md) to drive every gap to a fix with automatic alerts and tickets, [User Inventory](https://docs.threataware.com/user-inventory.md), [Software Inventory](https://docs.threataware.com/software-inventory.md), [Stealth Device detection](https://docs.threataware.com/stealth-devices.md) and [AI Advanced Reporting](https://docs.threataware.com/reporting.md). | > > For the full feature comparison, see [Compare plans](https://threataware.com/solutions/comparison) on our website. ## Security in brief > [!TIP] > > **Read-only API access.** ThreatAware never changes anything in your tools. On Protect, Action Center flows can send emails and requests that you set up. > [!TIP] > > **Encrypted in transit** (TLS 1.2+) and **at rest** (AES-256) > [!TIP] > > **ISO 27001** certified, **Cyber Essentials** certified, **GDPR** compliant > [!TIP] > > **UK data residency** by default; other regions on request > [!TIP] > > **No agents** to deploy or patch on your devices Full detail in [Trust & Security](https://docs.threataware.com/trust/security.md). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.