Frequently asked questions

Platform

Use Guardian to scan URLs, Intel to browse threat indicators, CVEs to research vulnerabilities, News to follow reporting, Investigate to look up indicators, and Campaigns to review sourced campaign intelligence. Use Public OSINT (preview) for public-profile, legal-entity and network research, plus image metadata inspection. Use ModelDex to discover AI models and provider access options; imported listings are labelled separately from reviewed entries. Use Arsenal to discover security tools, compare capabilities and inspect source evidence and review labels. A listing is not a guarantee of safety; use tools only with authorization. Product availability and coverage depend on the data and services currently available.

Guardian

The public scanner supports anonymous use with a browser-generated session identifier for history. Keep that identifier private: it controls access to your anonymous history. Rate limits apply. You can create an account or sign in to keep signed-in scans in your private dashboard. Earlier anonymous history is not automatically transferred. Use Forgot password if you lose access to a password account; Google and GitHub users should use their provider. Verification emails can be requested from Profile when email delivery is configured. Your Profile page manages your name and optional professional details; Settings includes appearance, time zone, password and session controls, and account deletion.

Guardian

Guardian reports LOW, MEDIUM or HIGH risk from the available scan signals. A LOW result is not a safety guarantee. Provider verdicts can disagree or be unavailable. Nemotron assessment confidence is certainty in its assessment, not a maliciousness score; read the explanation and source evidence alongside the number.

Guardian

When enabled and available, Nemotron receives the submitted URL and available scan context, including provider verdicts, machine-learning output and relevant prior scan summaries. It returns a separate analysis, risk flags, inconsistencies and recommendation. If it fails, Guardian can still return its underlying scan result.

Guardian

Deep scanning fetches supported public webpage content and checks content signals; it does not provide full browser execution or malware sandboxing. Bulk scanning accepts up to 10 URLs per request. Recent results may be cached; use Rescan when you need a fresh check.

Privacy

Submitted URLs, results and related history are stored. Depending on the check, URLs, domains, IPs or hashes are sent to threat providers; enabled AI analysis shares scan context with NVIDIA. Do not submit private links, password resets, credentials or personal access tokens. See the Privacy Policy for details.

Privacy

History and investigation queries that use saved scans are scoped to your account or anonymous session, not exposed as another user’s history. Clearing history deletes the accessible saved scan records and their associated feedback. It does not recall data already sent to providers or automatically remove caches, operational logs or backups.

Intelligence

The pages periodically refresh available source snapshots. Source publication times, caching, rate limits and outages affect freshness. OTX and CISA report ingestion is scheduled separately, normally every 15 minutes while the worker runs; a sleeping host can pause it. A refreshed page does not mean every upstream source just published new data.

Campaigns

Incoming reports enter a private review inbox. OTX pulses are indicator collections and CISA advisories may describe vulnerabilities rather than campaigns. Only reviewed records are published as campaigns. Historical MITRE ATT&CK entries remain historical; missing actor, victim or impact information is not invented.

Investigate

You can search URLs, domains, IPs, email addresses and MD5, SHA-1 or SHA-256 hashes. Results depend on available public feed matches, reviewed campaign indicators and your own saved scans. A lookup does not automatically run a new Guardian scan. No match means no evidence was found in that coverage, not that the indicator is safe.

Investigate

Investigation reports can be downloaded as JSON, CSV, PDF or a STIX bundle. STIX export is not a hosted TAXII service. Copying an indicator or downloading a blocklist does not enforce a block on your network; apply it through your own security tools after review.

CVEs and news

CVSS describes vulnerability severity; it does not establish whether your software version is affected or your system has been exploited. Check vendor advisories and CISA known-exploited context. News summaries and external articles belong to their original publishers and can change after aggregation.

Support

Use Guardian’s feedback controls for a correct verdict, false positive or missed threat. Feedback helps research and evaluation; it does not automatically retrain a model or change a verdict. For intelligence corrections, privacy requests or security disclosures, use the Contact page.

ModelDex

Open ModelDex and use catalog search and filters, or click the floating Ask ModelDex button. Describe your task, deployment preference, hardware and license needs. Follow-ups add requirements to the same project; New chat starts over. Drag the button to move it, or focus it and use arrow keys. You can adjust interpreted requirements and compare up to three models.

ModelDex

No. Local interpretation can match requirements without sending them to NVIDIA. Available NVIDIA interpretation is an opt-in option for signed-in users and has daily limits. If AI is unavailable, local interpretation can still return catalog candidates. Review the interpreted requirements, unknowns and conflicts before choosing.

ModelDex

Imported listings are provider-supplied and labelled separately from reviewed entries. A listing does not establish that access is free, that commercial use is permitted, or that the model fits your hardware. Check dated source evidence, licensing, provider quotas and workload-specific requirements. ModelDex does not host model inference or provide API credits.

Guardian

Use Message for suspicious text or Screenshot to upload an image and extract its text. Review and redact the extracted text before explicitly agreeing to NVIDIA analysis. These checks are separate from saved URL scans and are not stored in your dashboard or automatically used for training. They assess available text signals; they do not verify image authenticity or establish that a video is a deepfake.

CVEs and news

Open an individual CVE or news item to read its dedicated detail page and follow the original source links. Use Stored history on the feed pages to search retained news excerpts, CVEs and public indicators. Retrieval dates are shown separately from source dates; older observations do not establish current activity. The archive grows as feeds are fetched and is not a complete historical backfill. Details depend on the source data available. A news detail page is not a promise of full publisher article reproduction; consult the publisher for the complete story and the vendor advisory for patch guidance.

Open Public OSINT and choose People, Usernames, Organizations, Domains, IP addresses or Image evidence. People searches use Wikidata and Wikipedia references; usernames use GitHub, GitLab, Wikimedia and Bluesky public accounts; organizations use GLEIF and public reference records; domains use public DNS and certificate transparency; and public IPs use RIPEstat routing and registration data. Image evidence supports local English OCR and QR/barcode decoding when installed, optional AI/public-source research, evidence connections and user-triggered map-feature checks. Reverse-image service links are manual external tools; no automatic reverse-image search is claimed. Coverage and failures are shown for each source. This is not a universal people search or access to private social accounts.

No. Results remain separate source candidates. Compare original records, stable identifiers, dates and independent evidence before making a connection. The source coverage panel distinguishes no match, unavailable services and request limits. An outage or missing record does not prove that a person or account does not exist.

Upload a JPEG, PNG or WebP up to 5 MB and 20 megapixels to inspect dimensions, selected embedded metadata and a SHA-256 fingerprint. GPS extraction is off unless you explicitly enable it. Processing happens temporarily on our server without sending the image to intelligence or AI providers. This tool does not perform OCR, face recognition or deepfake detection; Guardian’s Screenshot tab is a separate text-analysis feature.

Searches are not saved to your dashboard or the public intelligence archive. Public-source responses are cached temporarily for up to ten minutes. Research notes stay in the current page’s memory and are lost when you clear or leave it unless exported. Use Export JSON to keep evidence and notes; protect exports that contain personal information or image coordinates.