Jon AbbottHow ThreatAware and Dimension work together

Fix the foundation. Then build on it.

We've just launched Dimension by ThreatAware, and the obvious question is how it fits with ThreatAware itself. The short answer: ThreatAware tells you the truth about your estate. Dimension lets your team use that data to build the security apps they need. The longer answer starts with a problem most security teams live with without realising it.

Most security tools are built on an asset list that is inaccurate.

Devices are counted twice, leavers' laptops linger, agents report healthy on machines that no longer exist. Every alert, report and decision built on top inherits those errors.

One device, several versions of the truth

Picture a laptop that never came back when its user left the business. Your EDR console says it’s healthy. Your MDM knows it by a different name, so your device count includes it twice. The user’s account was never switched off, so as far as your systems are concerned, they still work here. And an AI browser extension on that laptop still has access to their work email.

No single tool is wrong, exactly. Each one is telling the truth about its own slice of the estate. The problem is that nobody is putting the slices together.

This is the cyber hygiene gap: the difference between the controls you think are running and the ones that actually are. Until you close this gap, nothing you build on top can be trusted, no matter how clever it is.

Get the data right

ThreatAware fixes this foundation.

Our patented timeline matching engine reconciles data from every tool you connect into a single record per asset and shows the true state of every control that should be running on it.

Connect your security tools to ThreatAware and the conflicting entries of our laptop collapse into one record: one device, tied to the person who last used it, with an EDR agent that looks healthy in its own console but has stopped reporting.

ThreatAware’s Action Center can then alert the right team or raise a ticket to get the agent fixed, and the device is tracked until it is. With that clean record in place, and the agent fixed, you can ask the next questions and take the next steps.

Build on top of it

That’s where Dimension comes in. With Dimension, your team can join ThreatAware’s device inventory with the data no asset tool touches (HR records, identity and OAuth grants, web proxy, VPN and firewall logs) and turn them into purpose-built security apps in hours rather than months. Access reviews, MFA coverage, shadow AI: if your team can describe it, Dimension can build it.

For our laptop, your team can ask Dimension for what it needs in plain English, such as “show me the AI tools our staff are using that we haven’t approved”, or start from a ready-made app in Dimension's App Library. Dimension builds the app on ThreatAware’s device inventory, connected to your HR, identity and network data.

Now the pieces join up. ThreatAware has already established that this is one laptop and who last used it. HR records confirm that person has left the business. Identity data shows an OAuth grant giving an AI extension access to their work email.

Proxy logs show the laptop still talking to an AI service that nobody has approved. Put those four fragments together and you get one clear finding: this is a leaver’s laptop, still in use, with an unapproved AI tool connected to corporate email.

And because Dimension can act as well as detect, the app your team created can open a ticket to revoke that access and recover the device. A person approves the change before anything happens, and every step is recorded in an audit log.

That’s what each product brings. ThreatAware shows you it’s one laptop, identifies who last used it and drives the fix for its broken agent. Dimension adds everything around it and lets you do something about it.

From one device to the whole estate

Our laptop is one case of a much bigger problem: shadow AI, the AI tools people use at work without the security team knowing or approving. Shadow AI doesn’t arrive as a rogue server. It can arrive as a browser extension, an OAuth grant, a local model on a developer’s laptop, or a personal ChatGPT account on a corporate device. No single tool sees all of it, which is why most organisations end up running several tools and still can’t answer the basic question: who is using which AI, on which device, with what data?

The app your team built with Dimension can answer these questions across the whole estate.

It starts with ThreatAware’s inventory of every device and what’s installed on it, ties each device to a real person, then reads identity, proxy, VPN and firewall data to show every AI service in use, sanctioned or not, corporate account or personal, managed device or unknown.

So instead of one leaver’s laptop, you see every case like it, across every team in the business.

Why they work so well together

That picture is only as good as the data underneath it. Build the same app on raw tool data and it gets the laptop wrong. It counts two devices, believes the EDR console that says one of them is healthy, and can’t tell who either device belongs to. Build it on ThreatAware data and you can see what’s really there: one laptop, last used by someone who has left, with an AI extension that needs revoking.

Joining data is easy. Joining it correctly is the hard part, and it’s the problem our matching engine already solves. That’s why Dimension on ThreatAware gives you answers you can act on, rather than another list of maybes.

ThreatAware gets the data right and drives the fixes. Dimension lets you build whatever else you need on top. Together, they took a laptop nobody could account for and got it dealt with.

Start a Dimension free trial.