Question 1

What is ThreatLoops actually for?

Accepted Answer

ThreatLoops is a morning dashboard for the person who owns IT and security at a small or mid-sized organisation. Every day it pulls in vulnerabilities, vendor outages, and security news, then filters all of it down to the products you actually run. The goal is a five-minute read that ends with 'nothing needs me today' or 'these two things need me today' — not another feed to keep up with.

Question 2

What should I do first?

Accepted Answer

Add your stack. Everything else in the product is computed from it — Exposure, CVE matching, SaaS Status and the Estate Report all filter against the tools you list. Ten to twenty tools is usually enough to make the product useful. You can add more at any time from My Stack, and the starter packs in setup get you most of the way in one click.

Question 3

Can I go through setup again?

Accepted Answer

Yes. Settings has a 'Re-run setup' link that walks you back through mode, role, stack and interests. Nothing is deleted — re-running setup only adds to or updates what is already there.

Question 4

Why does my feed or Exposure page look empty?

Accepted Answer

Almost always because your stack is empty or very small. Exposure only shows vulnerabilities that intersect with products you have told us you run — that is the entire point of it, and it means an empty stack produces an empty page. Add tools in My Stack and the page fills within a second. If your stack has ten or more tools and Exposure is still empty, that is genuinely good news: nothing currently known affects you.

Question 5

Where does your data come from?

Accepted Answer

Vulnerabilities come from the public CVE record, enriched with CISA's Known Exploited Vulnerabilities catalog and FIRST's EPSS exploit-probability scores. Vendor availability comes from each vendor's own status page or status API — we poll roughly 115 of them. News comes from a curated set of security publications, researchers, podcasts and YouTube channels you can see and filter in Sources. We do not scan your network and we do not install anything. ThreatLoops works entirely from the list of products you tell it you run.

Question 6

What does KEV mean?

Accepted Answer

KEV is CISA's Known Exploited Vulnerabilities catalog: a list of vulnerabilities that have been confirmed as actively exploited in the real world, not just theoretically exploitable. If something in your Exposure list is marked KEV, treat it as the highest priority regardless of its CVSS score. Federal agencies are legally required to remediate KEV entries by a due date; the same due date is shown here as a useful benchmark.

Question 7

What is EPSS, and why does it differ from CVSS?

Accepted Answer

CVSS scores how bad a vulnerability would be if exploited. EPSS estimates how likely it is to actually be exploited in the next 30 days, expressed as a percentage. A CVSS 9.8 with an EPSS of 0.1% is usually less urgent than a CVSS 7.5 with an EPSS of 40%. ThreatLoops weighs both, plus whether it is on KEV and whether it is in your stack, into a single priority band so you do not have to do that arithmetic yourself.

Question 8

How is my exposure priority calculated?

Accepted Answer

Each item starts from its severity, then moves up for active exploitation (KEV), a high EPSS probability, known ransomware use, and a confident match to something in your stack. It moves down when the match to your stack is uncertain. The result is a band — Act now, Plan, or Monitor — rather than a raw number, because the band is the part that changes what you do this morning.

Question 9

Why is a CVE marked critical for me but not generally?

Accepted Answer

Because it matched a product in your stack. The same vulnerability is background noise for someone who does not run that product and an immediate task for someone who does. Every Exposure item shows the stack entry that pulled it in, so you can check the match. If it looks wrong, remove or rename that stack entry to something more specific.

Question 10

What is the lifecycle / end-of-life warning?

Accepted Answer

Software that has passed its end-of-support date stops receiving security patches, which quietly makes every future vulnerability permanent for you. ThreatLoops tracks published end-of-life dates for the products in your stack and flags the ones that have passed or are approaching, so migrations get planned rather than discovered.

Question 11

Are the summaries written by AI? Can I trust them?

Accepted Answer

The 'Why it matters' and 'Recommended action' lines are AI-generated from the underlying advisory, and the daily briefing headline is too. Everything factual around them — the CVE ID, CVSS, EPSS, KEV status, dates, vendor and links — comes straight from the source record and is never generated. Treat the summaries as a fast orientation and the linked source as the authority. Every item links back to where it came from.

Question 12

How often does the data refresh?

Accepted Answer

News feeds and vendor status are checked through the day; vulnerability data is refreshed daily. The indicator in the top bar shows how recently the last successful fetch completed — hover it for the exact timestamp. If it says feeds are stale for more than a few hours, that is on us, not you.

Question 13

What is the Action Queue for?

Accepted Answer

It is the list of things that survived the filtering: vulnerabilities and outages that touch your stack and have not been dealt with yet. Today tells you what happened; the Action Queue is where you work through it. Every item carries the fix already written, so the queue is meant to be emptied rather than read.

Question 14

What do Done, Snooze and Not relevant actually do?

Accepted Answer

Done removes the item from your queue and records it in the Evidence Log with a timestamp, so you can show later that it was handled. Snooze hides it for a week and then brings it back. Not relevant removes it permanently and tells us the match was wrong for your environment. None of the three deletes the underlying vulnerability — they change your queue, not the record. You can see everything you have closed in the Evidence Log.

Question 15

How are Alerts different from the Threat Feed?

Accepted Answer

The Threat Feed is news: everything published by the sources you follow, whether or not it touches you. Alerts is the opposite — only things that hit your stack right now, derived from live vendor outages and newly exploited CVEs in products you run. If you only open one page on a busy day, open Alerts. Acknowledging an alert clears it for you and leaves a record of who cleared it and when.

Question 16

What is on an incident timeline?

Accepted Answer

Click any vendor from Alerts or SaaS Status and you get that vendor's incident history folded into timelines: when the outage started, each status change we recorded while it ran, when it recovered, and how long the whole thing lasted. Every timeline links out to the vendor's own status page, because for a customer-facing postmortem you want to cite them, not us.

Question 17

Where does the daily summary at the top of Today come from?

Accepted Answer

It is generated once a day from your own data — your stack, your open items, your alerts — not from a generic newsletter. That is why two people on different stacks get different summaries on the same morning. It is cached for the day, so re-opening Today does not regenerate it and does not cost you anything. The facts underneath it are all clickable.

Question 18

What does Calm mode hide?

Accepted Answer

Low-priority news: items that are interesting but do not touch your stack and do not need a decision. Anything exploited, anything matched to your stack and every active outage still shows. It is the right default on a busy day. Turn it off when you want the full picture rather than the short one.

Question 19

What is the Patch Tuesday page?

Accepted Answer

Microsoft ships its security updates on the second Tuesday of each month. This page pulls that release straight from Microsoft's own advisory feed and sorts it the way you would triage it: exploited first, then publicly disclosed, then the rest. It refreshes as Microsoft publishes, so the page is usually populated the same evening.

Question 20

What happens when I upload a lockfile to Dependencies?

Accepted Answer

We read the package names and versions out of it and check them against OSV.dev, the open-source vulnerability database, then show you which packages have known vulnerabilities and which version fixes each one. We store the manifest name, the package count and the findings — not your source code, and not the lockfile itself. Nothing is sent anywhere except the package coordinates needed to run the lookup.

Question 21

What is Radar showing me?

Accepted Answer

Publicly reported breaches and ransomware victim disclosures, so you can see whether a supplier, a peer in your sector or a company in your region has been hit. It is context rather than a task list: the useful reaction to a supplier appearing here is usually a question to your account manager, not a patch.

Question 22

What is the Evidence Log for?

Accepted Answer

It is an append-only record of what you closed and when — every Done, every acknowledged alert, every report generated. When somebody asks how a vulnerability was handled six months ago, this is the answer. It is written automatically as you work. There is nothing to maintain, which is the only kind of audit trail that actually survives contact with a busy month.

Question 23

What is Impact Radar (MSP mode)?

Accepted Answer

A single grid across every client you manage: which clients are affected by each live issue, so you can see at a glance whether something is one client's problem or all of them. It is the fastest way to decide whether to send one email or twelve, and it links straight into each client's own view.

Question 24

What goes in the Posture Report?

Accepted Answer

A quarterly summary written for someone who does not read CVE numbers: how many issues arrived, how many were closed, how quickly, what is still open, and where the environment is ageing out of support. It carries your company name and prints cleanly to PDF, so it can go into a board pack or a client QBR as-is.

Question 25

What is 'Write the update'?

Accepted Answer

A drafting assistant for the message you have to send about an issue — to staff, to a client, or to a board. Pick the audience and it drafts a subject and body in the right register from the item you are looking at. It is a first draft, not an outgoing email: nothing is sent for you. Copy it, edit it, and send it from wherever you normally send things.

Question 26

What is the difference between Solo, Team and MSP mode?

Accepted Answer

Solo is one person looking after one environment: a personal brief and a calm feed, with no coordination overhead. Team adds shared briefings and read tracking so a group stays aligned on the same picture. MSP adds multiple client environments, each with its own stack and exposure view, plus per-client reporting. Mode changes what the product shows, not what it costs to switch. You can change mode any time in Settings.

Question 27

How do I add a teammate?

Accepted Answer

Switch to Team mode, then use Team Briefings to see your workspace. Seats are billed per additional member and can be adjusted from Settings → Billing.

Question 28

How do I add an MSP client?

Accepted Answer

In MSP mode, open MSP Clients and add the client with a name and, optionally, an industry. Each client gets its own stack, so exposure and reports are scoped to that client alone rather than a merged view.

Question 29

How many clients can I have?

Accepted Answer

The MSP plan includes a generous client allowance, and Settings → Billing shows your current count against it. During the trial you can add up to three clients, which is enough to see whether the per-client model fits how you work.

Question 30

What happens when my 30-day trial ends?

Accepted Answer

The app locks and asks you to pick a plan. Nothing is deleted — your stack, saved items and watchlists stay exactly as they were, and everything comes back the moment you subscribe.

Question 31

Which plan should I be on?

Accepted Answer

Solo if you are one person looking after one organisation. Team if several people need the same picture. MSP if you look after multiple client environments and need per-client exposure and reporting. Paying annually gets you two months free on any plan.

Question 32

How do I cancel or change my plan?

Accepted Answer

Settings → Billing opens your subscription portal, where you can switch plans, change billing interval, update payment details or cancel. Cancellations take effect at the end of the period you have already paid for.

Question 33

Where are my invoices?

Accepted Answer

In the same billing portal. Payments are processed by Paddle as merchant of record, so your invoices and any applicable tax handling come from there.

Question 34

Where are your terms, privacy and refund policies?

Accepted Answer

All of them are public and linked in the footer of every marketing page: Terms of Service at /terms, Privacy Policy at /privacy, Refund Policy at /refunds, and Security & Trust at /security. Each page shows the date it was last updated. We announce material changes by email or in-app before they take effect.

Question 35

Who operates ThreatLoops, and how do I contact you?

Accepted Answer

ThreatLoops is operated by Meekware LLC. Our legal entity, postal address and contact routes for support, billing, privacy requests and security reports are on the contact page at /contact. Payments are handled by Paddle.com as Merchant of Record, so invoices and refunds come from there.

Question 36

How do I get a copy of my data, or have it deleted?

Accepted Answer

Email support@threatloops.com from the address on your account with 'Privacy request' in the subject line, and say whether you want an export, a correction or a deletion. We respond within 30 days. Most of it is self-serve: your stack, clients, preferences and saved items are editable in the app, and closing your account removes them within 30 days.

Question 37

How long do you keep data?

Accepted Answer

News items are kept for 30 days unless you saved or read them, in which case they stay. Vendor status history is kept for 90 days. Vulnerabilities that are on KEV, or that are high severity, are kept indefinitely because they stay relevant for years. Settings → Data & retention shows the policy and when the last cleanup ran.

Question 38

What do you store about my environment?

Accepted Answer

The list of product names you enter, your preferences, and what you have saved or read. We do not connect to your systems, scan your network, or collect telemetry from your devices.

Question 39

How do I delete my account?

Accepted Answer

Email support from the address on your account and ask for deletion. We remove your stack, preferences, saved items and clients, and cancel any active subscription. Shared threat data — the CVE and news records themselves — is not user-specific and stays.

Question 40

Why am I not getting emails?

Accepted Answer

Because email delivery is not live yet. Notification preferences are saved and will apply the moment digests ship; until then everything is delivered in-app on the Today page. This is the single most common question we get, and the honest answer is that we would rather ship it late than ship a digest nobody trusts.

Question 41

A product I use is not in the list.

Accepted Answer

Add it anyway — the stack accepts free text. It will still be matched against vulnerability data by name; it just will not have a monitored status page until we add one. Tell us which product and we will add it to the catalog, which usually takes a day.

Question 42

A vendor shows as operational but I know they are down.

Accepted Answer

We report what the vendor's own status page reports, and vendors are often slow to update it. Where a vendor has no machine-readable status endpoint we link out to their page instead of guessing. Trust your users over a green dot; the dot is a second opinion, not a monitor of your own connectivity.

Question 43

I clicked my magic link and ended up back at sign-in.

Accepted Answer

Magic links are single-use and expire. Opening one in a different browser than the one you requested it from will also fail, which is the usual cause. Request a fresh link and open it in the same browser. If it still loops, clear site data for ThreatLoops and try once more.

Question 44

None of this helped.

Accepted Answer

Use the contact option at the bottom of this page. It attaches your current account diagnostics — plan state, stack size and last data refresh — which is almost always what we would ask for first, and gets you a real answer instead of a round trip.

How can we help?

Getting started

Understanding the data

Working the day

The deeper tools

Modes, teams and clients

Billing and trial

Legal and policies

Data and privacy

Troubleshooting