Frequently asked questions

Platform

Use Guardian to scan URLs, Intel to browse threat indicators, CVEs to research vulnerabilities, News to follow reporting, Investigate to look up indicators, and Campaigns to review sourced campaign intelligence. Product availability and coverage depend on the data and services currently available.

Guardian

The public scanner supports anonymous use with a browser-generated session identifier for history. Keep that identifier private: it controls access to your anonymous history. Rate limits apply. Where account access is available, signed-in history belongs to that account.

Guardian

Guardian reports LOW, MEDIUM or HIGH risk from the available scan signals. A LOW result is not a safety guarantee. Provider verdicts can disagree or be unavailable. Nemotron assessment confidence is certainty in its assessment, not a maliciousness score; read the explanation and source evidence alongside the number.

Guardian

When enabled and available, Nemotron receives the submitted URL and available scan context, including provider verdicts, machine-learning output and relevant prior scan summaries. It returns a separate analysis, risk flags, inconsistencies and recommendation. If it fails, Guardian can still return its underlying scan result.

Guardian

Deep scanning fetches supported public webpage content and checks content signals; it does not provide full browser execution or malware sandboxing. Bulk scanning accepts up to 10 URLs per request. Recent results may be cached; use Rescan when you need a fresh check.

Privacy

Submitted URLs, results and related history are stored. Depending on the check, URLs, domains, IPs or hashes are sent to threat providers; enabled AI analysis shares scan context with NVIDIA. Do not submit private links, password resets, credentials or personal access tokens. See the Privacy Policy for details.

Privacy

History and investigation queries that use saved scans are scoped to your account or anonymous session, not exposed as another user’s history. Clearing history deletes the accessible saved scan records and their associated feedback. It does not recall data already sent to providers or automatically remove caches, operational logs or backups.

Intelligence

The pages periodically refresh available source snapshots. Source publication times, caching, rate limits and outages affect freshness. OTX and CISA report ingestion is scheduled separately, normally every 15 minutes while the worker runs; a sleeping host can pause it. A refreshed page does not mean every upstream source just published new data.

Campaigns

Incoming reports enter a private review inbox. OTX pulses are indicator collections and CISA advisories may describe vulnerabilities rather than campaigns. Only reviewed records are published as campaigns. Historical MITRE ATT&CK entries remain historical; missing actor, victim or impact information is not invented.

Investigate

You can search URLs, domains, IPs, email addresses and MD5, SHA-1 or SHA-256 hashes. Results depend on available public feed matches, reviewed campaign indicators and your own saved scans. A lookup does not automatically run a new Guardian scan. No match means no evidence was found in that coverage, not that the indicator is safe.

Investigate

Investigation reports can be downloaded as JSON, CSV, PDF or a STIX bundle. STIX export is not a hosted TAXII service. Copying an indicator or downloading a blocklist does not enforce a block on your network; apply it through your own security tools after review.

CVEs and news

CVSS describes vulnerability severity; it does not establish whether your software version is affected or your system has been exploited. Check vendor advisories and CISA known-exploited context. News summaries and external articles belong to their original publishers and can change after aggregation.

Support

Use Guardian’s feedback controls for a correct verdict, false positive or missed threat. Feedback helps research and evaluation; it does not automatically retrain a model or change a verdict. For intelligence corrections, privacy requests or security disclosures, use the Contact page.