Defense.com Threat Analysis agent skills for Claude Code, Cursor and RevampKey

4 ready-made playbooks that teach an AI agent how to do real Defense.com Threat Analysis work: which tools to call, what to check first, and when to stop and ask you.

Download RevampKey, free I have it: connect Defense.com Threat Analysis

Connect Defense.com Threat Analysis once and all 4 skills install themselves and stay up to date. Mac, Windows and Linux.

All 4 Defense.com Threat Analysis skills

Each skill is one job. You ask in plain words and the agent loads the skill that matches, then follows its steps.

Start hereRead-only16 Defense.com Threat Analysis tools

Use the Defense.com Threat Analysis connector safely

Explains how to point the AI at the right account and scope, choose between threat, detection, workload and training tools, and avoid changing training records without your approval.

Use it when

You have just connected Defense.com Threat Analysis and want to know what it can do.
A threat list came back empty or only partly and you want to know why.
You want the AI to start or submit a training session and need to check it asks first.

Tools it uses

get_biggest_risks
get_threat_to_remediate_first
get_new_threats
search_threats_by_keyword
get_threat_details_with_context
get_threats_by_assignee
get_threats_by_source
get_latest_detections
get_workload_analysis
get_security_awareness_brief
generate_training_questions
get_training_for_threat
start_training_session
submit_training_answer
get_training_hint
get_training_session_status

Example

Which Defense.com tool should I use to see what threats to fix first today, and check it for our main account only?

I'll use the risk and remediate-first views, scoped to your main account over the last 24 hours. I found 12 open threats in that window: 5 high, 4 medium and 3 low. I'm showing the top 6 by priority and will fetch the next page if you want the rest. Nothing has been changed in your training records.

Use in RevampKeyRead the full skill →

Read-only12 Defense.com Threat Analysis tools

Build a security awareness plan from your real threat exposure

Turns the threats Defense.com shows you as most serious into training questions and a short session plan. It asks for your approval before starting a session or recording any answers.

Use it when

You want security training that covers the lures your team is actually facing
You need a quick quiz for an upcoming awareness week
You want to check which recent threats are missing from your current training

Tools it uses

get_biggest_risks
get_new_threats
get_latest_detections
get_threat_details_with_context
generate_training_questions
get_training_for_threat
get_security_awareness_brief
get_threats_by_assignee
start_training_session
submit_training_answer
get_training_session_status
get_training_hint

Example

Build a 25-minute awareness session on the top two threats we saw this month, with quiz questions for each.

I suggest two topics: a fake invoice from a lookalike domain (high risk, detected 14 times this month) and a credential-reset phishing lure (recently appeared, detected 6 times). The session has 8 questions, 4 per topic. I found existing material for the invoice topic but none for the reset lure, so I'd recommend a short brief for it. I haven't started any session; tell me when to proceed.

Use in RevampKeyRead the full skill →

Read-only5 Defense.com Threat Analysis tools

Investigate a threat in Defense.com with AI

Works through one threat or keyword cluster end to end, checking its details, source, affected workloads and related detections. It ends with a write-up that separates what is confirmed from what is still open, and it asks before changing anything.

Use it when

A specific threat has been flagged and needs a written assessment
A keyword is matching threats and you need to know whether it is a real problem
You need a threat summarised for an incident ticket

Tools it uses

search_threats_by_keyword
get_threat_details_with_context
get_threats_by_source
get_workload_analysis
get_latest_detections

Example

Investigate the threat named 'credential harvest via invoice links' and tell me what it touched and how it got in.

I found one matching threat, first seen 3 days ago and still active. It shares a source with 2 other threats, and its workload impact covers 4 workloads, 1 of them marked critical. Confirmed: the threat record and the 4 affected workloads. Unconfirmed: the entry route, since the source data does not establish it. Recommended next step: isolate the critical workload, and I will not change anything until you approve it.

Use in RevampKeyRead the full skill →

Read-only9 Defense.com Threat Analysis tools

Triage your Defense.com threat queue with AI

Ranks open Defense.com threats by severity, spread and ownership, and splits them into what to act on today and what can wait. It reads the queue and does not change assignments or threat state without asking.

Use it when

You start the day and want to know which threats need attention first.
You want the biggest risks and the remediate-first list merged into one queue.
You need to spot severe threats that nobody owns yet.

Tools it uses

get_biggest_risks
get_threat_to_remediate_first
get_new_threats
get_latest_detections
search_threats_by_keyword
get_threats_by_assignee
get_threats_by_source
get_workload_analysis
get_threat_details_with_context

Example

What should my team work on first today from the open Defense.com threats?

Your queue has 4 items for today. The top one is a high-severity threat seen across 3 hosts and it has no assignee, so it needs an owner now. The other three are ranked by spread and recent detections. Nothing has been reassigned or closed.

Use in RevampKeyRead the full skill →

Get all 4 without copying a file

RevampKey adds the skills when you connect Defense.com Threat Analysis, updates them for you and removes them when you disconnect.

Download RevampKey

How Defense.com Threat Analysis skills work

Connect Defense.com Threat Analysis
The Defense.com Threat Analysis MCP server gives the agent its tools.
Ask in plain words
“Build a 25-minute awareness session on the top two threats we saw this month, with quiz questions for each.” Each SKILL.md says when it applies, so only the one that fits is loaded.
Approve any change
The agent calls the tools in order, checks its work, and shows you any change before it makes it.

How to install Defense.com Threat Analysis skills

In RevampKey the skills install themselves when you connect Defense.com Threat Analysis. In other tools each skill is one folder with a SKILL.md file, and you also need the Defense.com Threat Analysis MCP server connected there.

About 1 minute · nothing to copy

Download RevampKey for Mac, Windows or Linux and sign in.
Open Connectors and connect Defense.com Threat Analysis. All 4 skills come with it and stay up to date; they go away when you remove the connector.
Ask in plain language, for example “Build a 25-minute awareness session on the top two threats we saw this month, with quiz questions for each.”
Download RevampKeyConnect Defense.com Threat Analysis · 1 click
Get RevampKey to connect Defense.com Threat Analysis
RevampKey is a free desktop app for Mac, Windows and Linux. Install it, sign in, and Defense.com Threat Analysis is one click away with its skills already attached.
Download RevampKey
Not now? Use the skills in your current tool
for s in essentials security-training-plan threat-investigation threat-triage; do curl -fsSL --create-dirs -o .claude/skills/defense-com-threat-analysis-$s/SKILL.md https://revampkey.com/marketplace/defense-com-threat-analysis/skills/$s/SKILL.md done
Other tools

Into this project’s .claude/skills folder

Connect the Defense.com Threat Analysis MCP server in Claude Code.

Run this in your project folder to add all 4 skills:

for s in essentials security-training-plan threat-investigation threat-triage; do
  curl -fsSL --create-dirs -o .claude/skills/defense-com-threat-analysis-$s/SKILL.md https://revampkey.com/marketplace/defense-com-threat-analysis/skills/$s/SKILL.md
done

Ask in plain language, for example “Build a 25-minute awareness session on the top two threats we saw this month, with quiz questions for each.”

Into the shared .agents/skills folder

Connect the Defense.com Threat Analysis MCP server in Cursor.

Run this in your project folder to add all 4 skills:

for s in essentials security-training-plan threat-investigation threat-triage; do
  curl -fsSL --create-dirs -o .agents/skills/defense-com-threat-analysis-$s/SKILL.md https://revampkey.com/marketplace/defense-com-threat-analysis/skills/$s/SKILL.md
done

Ask in plain language, for example “Build a 25-minute awareness session on the top two threats we saw this month, with quiz questions for each.”

Into the shared .agents/skills folder

Connect the Defense.com Threat Analysis MCP server in Codex.

Run this in your project folder to add all 4 skills:

for s in essentials security-training-plan threat-investigation threat-triage; do
  curl -fsSL --create-dirs -o .agents/skills/defense-com-threat-analysis-$s/SKILL.md https://revampkey.com/marketplace/defense-com-threat-analysis/skills/$s/SKILL.md
done

Ask in plain language, for example “Build a 25-minute awareness session on the top two threats we saw this month, with quiz questions for each.”

Into the shared .agents/skills folder

Connect the Defense.com Threat Analysis MCP server in VS Code.

Run this in your project folder to add all 4 skills:

for s in essentials security-training-plan threat-investigation threat-triage; do
  curl -fsSL --create-dirs -o .agents/skills/defense-com-threat-analysis-$s/SKILL.md https://revampkey.com/marketplace/defense-com-threat-analysis/skills/$s/SKILL.md
done

Ask in plain language, for example “Build a 25-minute awareness session on the top two threats we saw this month, with quiz questions for each.”

RevampKey or copy the files?

In RevampKey

One click when you connect Defense.com Threat Analysis
Updated for you when a skill improves
Removed when you disconnect
The MCP server is set up for you
800+ other connectors, same way

Download free

Copy into your project

One command per project
Run it again to get updates
You connect the Defense.com Threat Analysis MCP server yourself
Works in Claude Code, Cursor, Codex and VS Code

See the command

Defense.com Threat Analysis skills FAQ

What is a Defense.com Threat Analysis agent skill?

A SKILL.md file: a short playbook an AI agent loads when your request matches it. Each Defense.com Threat Analysis skill describes one job, which Defense.com Threat Analysis tools to use in which order, what to check first and when to stop and ask you.

Do the Defense.com Threat Analysis skills change anything on their own?

4 of the 4 only read. The others tell the agent to show you the change and wait for a yes before it creates, edits or deletes anything in Defense.com Threat Analysis.

Which tools can use these skills?

Any agent that reads the open Agent Skills format: Claude Code, Cursor, Codex, VS Code with Copilot and RevampKey. In RevampKey they are attached when you connect Defense.com Threat Analysis; elsewhere you copy the folders into your project or skills directory.

Do I need the Defense.com Threat Analysis MCP server too?

Yes. The skills tell the agent how to do the work; the Defense.com Threat Analysis MCP server gives it the tools to do it. The Defense.com Threat Analysis MCP setup guide covers every client.

Defense.com Threat Analysis MCP server setup · This page as Markdown

Put Defense.com Threat Analysis’s best workflows in your agent

Download RevampKey, connect Defense.com Threat Analysis and ask your first question in about a minute.

Download RevampKey Connect Defense.com Threat Analysis · 1 click

All 4 Defense.com Threat Analysis skills

Use the Defense.com Threat Analysis connector safely

Use it when

Tools it uses

Build a security awareness plan from your real threat exposure

Use it when

Tools it uses

Investigate a threat in Defense.com with AI

Use it when

Tools it uses

Triage your Defense.com threat queue with AI

Use it when

Tools it uses

Get all 4 without copying a file

How Defense.com Threat Analysis skills work

How to install Defense.com Threat Analysis skills

RevampKey or copy the files?

In RevampKey

Copy into your project

Defense.com Threat Analysis skills FAQ

Put Defense.com Threat Analysis’s best workflows in your agent

Skills for related tools