Part of Defend, in progress — Threat Intel and Security are now part of Defend, not separate products. This area is still being built: some screens, menu names and actions described here may not be available yet, or may still show the older Threat Intel or Security names.
Overview
Defend threat intelligence provides two types of reporting: the MSP-wide dashboard with an Intel Briefing for operational review, and Threat Narrative — AI-generated executive briefings for client QBRs, available on the Complete tier. MSP security analysts use the dashboard for ongoing monitoring, and deliver Threat Narratives to client stakeholders at quarterly business reviews.
The Dashboard
The dashboard shows aggregate counts across every client tenant:
- New findings this week
- Unresolved breaches
- Open vendor alerts
- Lookalike domain registrations
This is the starting point for a weekly review. It gives you a cross-client picture of active threats and unresolved items.
Intel Briefing
The Intel Briefing is a tenant-scoped summary available from the dashboard. It provides a condensed view of a single client's current threat posture — findings, trends, and open items — scoped to the selected tenant. Use it when reviewing a specific client's status or when preparing for a client call.
Threat Narrative — AI QBR Briefing (Complete Tier)
Threat Narrative is an AI-generated executive briefing built for delivery at quarterly business reviews. It is produced by THEO, the platform's AI assistant, and outputs as HTML ready to copy into a QBR presentation or send directly to client stakeholders.
Generating a Threat Narrative
- Go to Threat Narrative.
- Click Generate.
- Select the client tenant and the reporting period (typically the current quarter).
- THEO pulls data from the reporting window: dark-web findings, lookalike detections, vendor alerts, and breach trends.
- Review the narrative in the preview panel.
- Click Export to download the HTML file.
THEO composes the narrative as an executive-facing document — it describes trends and notable events in plain language without exposing raw technical data. If THEO is unavailable, the system falls back to deterministic prose generation.
Export and Delivery
The exported file is standard HTML. You can open it in a browser and use print-to-PDF to produce a PDF copy for delivery. Drop it into a QBR deck or send it directly to the client contact.
Remediation Plans
Each individual breach finding also has a per-finding remediation plan. This is not a summary report — it is a step-by-step action list tailored to the specific breach and data classes exposed (for example, rotate specific passwords, enable MFA on affected accounts, check mail forwarding rules). Export the remediation plan to PDF using browser print-to-PDF and share it with the affected user or client contact.
FAQ
Threat narrative generation is very slow or failed partway through. THEO has a timeout. Retry the generation. If it repeatedly fails, try a shorter reporting window — very large windows with high data volumes can overload the summarizer.
Can I generate a Threat Narrative for multiple clients at once? Each narrative is generated per client per reporting period. There is no batch generation option described in the current documentation.
The Intel Briefing shows data I do not recognize for a client. Verify you have selected the correct client tenant from the dropdown. Each Intel Briefing is scoped to a single tenant and should reflect only that client's monitors and findings.