Findings

Every hour, Beacon Cloud reviews the new activity your connected devices forwarded and surfaces what is worth your attention as findings. They are on the Findings page at beacon.sh/dashboard/findings. Findings are separate from the local beacon scan results, which run open threat rules on the machine and never leave it.

​

Kinds of findings

Each finding shows what happened, how severe it is, which sessions and harnesses it came from, and a recommendation. A skill finding has a Download skill button that saves the drafted SKILL.md, and findings carry a prompt you can copy into your agent to fix the problem.

​

Review a finding

• Filter the list by kind (security, skills, behavior) and severity. Findings that still need review come first.
• Open a finding to read its detail, the sessions it cites and the events it rests on. On Beacon Cloud Pro the full evidence trail is shown.
• Use Mark as to set a finding open, resolved or dismissed.
• Mark it helpful or not helpful and add a note. The next analysis reads your feedback, so it stops repeating what you rejected.

A finding that recurs updates the one you already have instead of creating a duplicate.

​

Your first findings

Beacon Cloud analyzes a new account soon after its first sessions arrive, including the 30 days of history a device uploads when it connects. You get one email with your first findings right after that analysis. Later findings arrive in a daily digest on the free plan, or as real-time email alerts on Pro.

​

Plan limits

Every finding counts toward the free allowance, whatever its status. Once a free account has used it, Beacon Cloud stops analyzing its new activity; its sessions keep uploading and stay searchable. After an upgrade, findings resume from the next new telemetry. See Plans and pricing.

​

Findings from your agent

On Beacon Cloud Pro, Beacon Cloud MCP lets the agent you are working in list your findings (beacon_findings_list), read one with its evidence (beacon_get_finding) and record your feedback or status (beacon_finding_feedback, which needs write access). Both beacon_get_finding and beacon_finding_feedback accept a finding’s dashboard URL.

​

How analysis handles your data

• Only activity from devices you connected is analyzed, in an isolated sandbox per account.
• Events are projected to a compact, redacted record before analysis, so a secret is reported from Beacon’s redaction marker rather than its value.
• Every finding must cite events from your own sessions.
• On a device forwarding in Metadata-only mode, prompts, responses, tool arguments and output never reach Beacon Cloud, so findings can only use what was sent. See What leaves your machine.

​

Related