Settings & Security¶

Audience: All client users (for your own profile, MFA, and notification preferences) · Where: Settings in the sidebar (/settings).

Overview¶

Settings is where you manage your personal account — your profile, your login security, and how you're personally notified. Every user sees three tabs:

Profile

Your email, display name, and phone.
Security

Two-factor authentication (MFA).
Notifications

Your personal notification preferences.

Members and viewers also get three read-only tabs showing how the organization is set up (owners and managers edit these in Administration instead, and are sent there if they open the Settings URL):

Tab	What it shows	Full guide
Licenses	What your organization owns and how much is used.	Licenses & Credits
SLA Targets	How many days each severity has to be fixed in.	SLA Targets
Integrations	Which source-code providers are connected.	Integrations

Profile¶

On the Profile tab, update your Email, Display Name, and Phone, then click Save changes. This is your personal profile, not organization-wide settings.

Security: two-factor authentication (MFA)¶

Two-factor authentication (2FA/MFA) adds a second step to sign-in — a rotating code from an authenticator app — so a stolen password alone can't get into your account. The Security tab shows your status as Enabled (with the date it was added) or Not enrolled.

Enrolling¶

Click Set up two-factor authentication.
Scan the displayed QR code with a TOTP authenticator app (Google Authenticator, 1Password, Authy, etc.) — or type the secret in manually.
Enter the 6-digit code the app is showing and click Verify and enable.

Once enrolled, you'll be asked for a code from your authenticator each time you sign in.

Removing it¶

Click Remove and confirm to unenroll — for example before switching devices — then re-enroll with the new device. If your organization requires MFA, Remove is disabled; ask an administrator to reset it for you instead.

Organization-enforced MFA

Some organizations require MFA. If yours does and you haven't set it up, the portal will send you to the enrollment screen before you can continue. If you're a newly invited user in such an org, complete enrollment first — then you'll reach your dashboard.

Notifications¶

The Notifications tab (Notification preferences, at /settings/alerts) controls how you personally get notified about assessments and attack-surface changes. This is per-user — it only affects your own notifications, and you only ever receive alerts for assessments and assets you have access to.

Under Your notifications, each alert type (a new critical finding, an assessment completing, an ASM change, etc.) has three switches:

Switch	Behavior
In-app	Show the alert in the notification bell and your notifications inbox.
Email	Also send it to your account email.
Mute	Opt out of that alert type entirely (turning it on disables the other two).

Changes save as you toggle; the defaults are in-app on, email off, nothing muted. To read past notifications, open the bell in the top bar and choose View all notifications — see Activity & Notifications.

Organization-wide alerts (owners and managers)¶

Shared delivery and org-wide rules are set up in Administration → Alerts (owners and managers see a Manage in Administration link on this tab). That panel has three parts:

Delivery channels — named destinations: an Email address, or a Webhook URL sent as Generic JSON or in Slack / Discord format.
Alert rules — for an Event, an optional Minimum severity, and which Channels to deliver to. Rules can be disabled without deleting them.
Recent deliveries — a log of what was sent (Event, Channel, Target, Status, When), useful for checking a webhook is working.

Tips¶

Protect your account

Enroll in MFA even if it isn't required — it's the single biggest protection for your account, and these are security findings you don't want to be.
Keep your authenticator app's backup/recovery method safe so you don't get locked out when you change phones.
Profile changes here affect only you; organization-wide settings (members, teams, SSO, security policy, licenses, integrations, alerts, API keys, the credential vault, OVA appliances, and the audit log) live in the manager/owner Administration console.