Having extensively evaluated ThreatConnect's platform for orchestrating security operations over the past two years, I've formed a generally positive view of its core web application, particularly for complex playbook automation and intelligence management. However, the mobile application experience stands in stark, disappointing contrast. It appears to be a severely feature-crippled afterthought rather than a functional extension of the platform, which is problematic for on-call SREs or security engineers who need situational awareness during incidents.
My primary criticisms are data-driven and based on daily usability tests:
* **Information Density & Context Loss:** The mobile app presents a fraction of the data available in the web UI. Indicator details, critical context from associated Groups, and rich text fields are often truncated or omitted entirely. For a platform built on connecting disparate pieces of intelligence, this renders the mobile view almost meaningless for decision-making.
* **Action Impairment:** Most workflow actions are missing. You cannot:
* Execute or modify Playbooks.
* Add meaningful Analysis or Comments with proper formatting.
* Effectively triage or assign Incidents.
* Utilize the collaborative features that define ThreatConnect's value proposition.
* **Performance & Notification Latency:** Inconsistent push notification delivery, especially for time-sensitive alerts, has been observed. When notifications do arrive, tapping them frequently leads to a generic dashboard instead of deep-linking to the specific alert, forcing a manual search—an unacceptable delay during a potential security event.
This creates a paradoxical situation where, during off-hours incidents, I am forced to open my laptop because the dedicated mobile tool cannot provide the necessary fidelity or control. For a platform at this maturity and price point, the mobile experience should be more than a read-only notification mirror. I've attempted to quantify the gap by comparing available UI actions per entity type between the web and mobile interfaces, and the disparity is significant.
| Entity Type | Web UI Actions | Mobile App Actions | Functional Coverage |
| :--- | :--- | :--- | :--- |
| **Indicator** | Analyze, Tag, Associate, Add to Group, Block, etc. | View, (limited) Share | ~15% |
| **Incident** | Full Edit, Run Playbooks, Add Logs, Assign, etc. | View, Edit Status (basic) | ~10% |
| **Playbook** | Execute, Edit, Version, Debug | None (view-only, if listed) | 0% |
Has anyone else in the community conducted a similar analysis or found workarounds for these limitations? I'm particularly interested if any teams have leveraged the TC REST API to build a lightweight internal mobile dashboard as a stopgap, though that shouldn't be necessary. The lack of a robust mobile client seems a critical oversight for modern, cloud-centric security teams who are not always at a desk.
—chris
—chris
That's a really detailed point about the missing context on mobile. When the connections between data points are the whole value of a platform, stripping them out basically leaves you with a list of scary-looking strings and no way to understand why they're scary.
I'm curious, since you've been using it for two years - do you think this is a fundamental design flaw for mobile, or could they actually surface the right condensed intelligence if they prioritized it? Like a "mobile-optimized summary" view for each indicator that pulls the key linked entities?
As someone who builds dashboards, I always struggle with what to cut for a smaller screen without losing the narrative. Sounds like ThreatConnect just removed the narrative entirely 😬
That's a crucial point about dashboard design. Condensing without losing the narrative is the central challenge. I disagree that it's an unsolvable flaw for mobile; it's a prioritization failure. The "mobile-optimized summary" you suggest is exactly what's missing.
They could implement a context-aware view that surfaces, for example: the primary associated adversary or campaign, the last two related security events from my environment, and the status of any active playbook tied to the indicator. That's three data points providing immediate operational context, replacing a list of fifty raw attributes.
The fact they haven't suggests mobile access isn't part of their user workflow analysis, which is a significant oversight for a security operations platform. Engineers need to triage from anywhere, not just at a desk.
—at