> ## Documentation Index > Fetch the complete documentation index at: https://docs.getthread.com/llms.txt > Use this file to discover all available pages before exploring further. # How security work flows through Thread > For the security owner: how tickets surface in Inbox via Magic Sentiment, how Super Magic runs read-only investigation, and NinjaOne device actions. export const MarkComplete = ({id, signalDone = false}) => { const KEY = "thread-onboarding-completed"; const read = () => { try { return JSON.parse(localStorage.getItem(KEY) || "[]"); } catch (e) { return []; } }; const [localDone, setLocalDone] = useState(false); const done = signalDone || localDone; useEffect(() => { const sync = () => setLocalDone(read().includes(id)); sync(); window.addEventListener("thread-onboarding-updated", sync); return () => window.removeEventListener("thread-onboarding-updated", sync); }, [id]); const toggle = () => { if (signalDone) return; const list = read(); const next = list.includes(id) ? list.filter(x => x !== id) : [...list, id]; try { localStorage.setItem(KEY, JSON.stringify(next)); } catch (e) {} setLocalDone(next.includes(id)); window.dispatchEvent(new Event("thread-onboarding-updated")); }; return ; }; export const ByRoleProgress = () => { useEffect(() => { const KEY = "thread-onboarding-completed"; const TEAL = "#00B398"; const BASE = "/start-here/roles/"; const DONE_ICON = ''; const COURSES = [{ slug: "technician", steps: ["why-thread", "get-around-inbox", "day-one-setup", "daily-workflows", "ai-toolkit", "notifications-and-customers"] }, { slug: "dispatcher", steps: ["why-dispatch-in-thread", "read-the-board", "assign-and-schedule", "ai-for-dispatch"] }, { slug: "service-ops-manager", steps: ["set-up-the-desk", "sla-and-dispatch", "analytics-and-qa", "roll-out-and-adopt"] }, { slug: "csm-account-manager", steps: ["client-intelligence-and-health", "qbrs-and-reporting", "retention-and-expansion"] }, { slug: "security-compliance-owner", steps: ["security-work-in-thread", "data-and-compliance", "security-runbooks"] }, { slug: "sales-business-development", steps: ["the-ai-service-pitch", "quote-and-handoff"] }, { slug: "msp-owner-leadership", steps: ["the-rollout", "outcomes-and-analytics", "scale-ai-service"] }, { slug: "automation-engineer", steps: ["flows-and-intents", "thread-mcp-and-api", "build-with-super-magic"] }]; const COURSE_SLUGS = new Set(COURSES.map(c => c.slug)); const readLocal = () => { try { return JSON.parse(localStorage.getItem(KEY) || "[]"); } catch (e) { return []; } }; const isDone = (done, id) => done.includes(id); const decorate = () => { const done = readLocal(); const scope = document.getElementById("sidebar-content") || document; const links = [...scope.querySelectorAll('a[href*="' + BASE + '"]')].filter(a => !a.closest("main")); links.forEach(a => { const m = (a.getAttribute("href") || "").match(/\/start-here\/roles\/([^/?#]+)\/([^/?#]+)/); if (!m) return; if (!COURSE_SLUGS.has(m[1])) return; const id = m[1] + "/" + m[2]; const d = isDone(done, id); const has = a.querySelector(".thread-rc-check"); if (d && !has) { const s = document.createElement("span"); s.className = "thread-rc-check"; s.textContent = "✓ "; s.style.color = TEAL; s.style.fontWeight = "700"; a.insertBefore(s, a.firstChild); } else if (!d && has) { has.remove(); } }); COURSES.forEach(course => { const li = scope.querySelector('li[id="' + BASE + course.slug + '"]'); if (!li) return; const row = li.querySelector(":scope > button") || li.querySelector(":scope > a") || li.firstElementChild; if (!row) return; const nameSpan = [...row.querySelectorAll("span")].find(s => s.textContent.trim() && !s.classList.contains("thread-rc-coursecheck")); if (!nameSpan) return; const allDone = course.steps.length > 0 && course.steps.every(s => isDone(done, course.slug + "/" + s)); const has = nameSpan.querySelector(".thread-rc-coursecheck"); if (allDone && !has) { const s = document.createElement("span"); s.className = "thread-rc-coursecheck"; s.setAttribute("aria-hidden", "true"); s.style.display = "inline-flex"; s.style.alignItems = "center"; s.style.verticalAlign = "-0.2em"; s.style.marginRight = "0.35em"; s.innerHTML = DONE_ICON; nameSpan.insertBefore(s, nameSpan.firstChild); } else if (!allDone && has) { has.remove(); } }); }; decorate(); const iv = setInterval(decorate, 600); window.addEventListener("thread-onboarding-updated", decorate); window.addEventListener("storage", decorate); return () => { clearInterval(iv); window.removeEventListener("thread-onboarding-updated", decorate); window.removeEventListener("storage", decorate); }; }, []); return null; }; Security work is a queue problem before it's an incident problem: the alert, the report, the "is this phishing?" all land as threads in Inbox alongside everything else. Thread's job is to make the risky ones surface early, give you a read-only investigator that never changes state until you say so, and let you take contained device actions without leaving the ticket. This lesson walks the path a security thread takes and where your controls sit on it. ## Where security signals surface Every thread carries a live sentiment score, and for security that's a useful early-warning layer: a user who's been phished or locked out reads as frustrated fast, and [Magic Sentiment](/assistive-ai/configure-sentiment) scores that from the conversation and rolls it up to a company average. Watch the low-scoring threads — they're often the ones where something is actually wrong. Sentiment is also an escalation trigger. You can configure a low score to fire an automatic escalation and post a recap using a template your team defines, so a souring security thread routes to the right board or person without a human noticing it first. Sentiment analysis starts only after the customer has sent at least three messages, and the very first message is excluded — early frustration is normal in IT support. Treat the score as a trend signal on a live conversation, not a verdict on the first line. Configure both the score behavior and the escalation-plus-recap wiring on [Configure Magic Sentiment](/assistive-ai/configure-sentiment). Set the escalation template so a security thread that crosses your threshold lands where your responders will see it. ## Investigate with Super Magic — read is always safe [Super Magic](/super-magic/meet-super-magic-your-ai-assistant-in-the-inbox) is your investigator in the ticket. It reads freely — tickets, contacts, clients, and knowledge — and looking things up never changes anything, so you can dig without touching state. Open it while viewing a thread and it already has that ticket's context. ```text Security lookups (read-only) theme={null} Show me every open ticket for Acme flagged as a security issue Who is this sender, and have we seen this domain before across our clients? Pull the recap and the last 10 messages on this thread for my incident notes What do we know about this contact — devices, recent tickets, prior incidents? Search the KB for our BEC verification procedure ``` The one rule that matters for your review: **read never mutates.** Search, lookups, and summaries are always available to every member and never change your PSA. That's why you can hand Super Magic to your whole desk for investigation without loosening any control. ## Act only with confirmation When investigation turns into response, Super Magic switches modes — and this is the safety property to put in front of whoever reviews security at your company: * **Every write action shows a Confirm action card first.** Before anything changes, you see the exact action, a plain-language description, and every detail (which ticket, which status, which contact). Nothing runs until you click **Confirm**. * **Actions record under the individual member, never a faceless service account.** When a responder confirms an escalation or note, the ticket history shows *that person* did it. Accountability holds end to end. * **Access is layered and admin-controlled.** Write access is set to All members, Admins only, or a custom list, with a per-tool toggle on every action. Intents and Flows are always admin-only. You configure all of this from the [Super Magic admin guide: setup, access & safety](/super-magic/super-magic-admin-guide-setup-access-safety) — the write-access model, the per-tool toggles, and the confirmation behavior are the controls to document for an assessor. For irreversible or sensitive response steps — resetting sessions, disabling accounts, releasing a quarantined message — read the Confirm action card line by line before you click. The card exists precisely so a security action is a deliberate decision, not an autocomplete. ## Take device action from the ticket — with NinjaOne When a security thread needs a machine touched — reboot a compromised endpoint, restart a service, flip maintenance mode, reset an alert — [NinjaOne connected to Super Magic](/super-magic/connecting-ninja-one-to-super-magic) lets you do it from the chat instead of pivoting to the RMM. Two properties make this safe to allow: 1. **Device actions are writes, so they're always behind a Confirm action card.** Look-ups (device health, active alerts, recent activity, Windows services) are read-only; reboots, service restarts, maintenance mode, alert resets, and device approvals all confirm first. 2. **Each member acts under their own NinjaOne permissions.** NinjaOne connects in two layers — an admin configures the workspace connection once, and every technician signs in with their *own* NinjaOne account. Super Magic can never do more on a device than that member could do signed into NinjaOne directly, so your existing NinjaOne role assignments keep enforcing. NinjaOne for Super Magic is a limited release. Contact your Thread account team to enable it, then follow the two-layer setup on [Connect NinjaOne to Super Magic](/super-magic/connecting-ninja-one-to-super-magic). ## Next That's how security work moves through the desk. Next: the data-handling and permissions story you'll defend to clients and auditors. Encryption, Magic AI privacy, sub-processors, IP allowlisting, and app permissions. ## Related topics - [Security & Compliance Owner](/start-here/roles/security-compliance-owner.md) - [Abnormal Security](/skill-library/vendor-runbooks/abnormal-security.md) - [How to Manage Your Inbox Notifications](/notifications/managing-your-inbox-notifications.md)