Abstract: Dashboards for displaying threat insight information are provided herein, as well as systems and methods for generating the same. According to some embodiments, methods for providing a threat dashboard may include locating metrics regarding a malicious attack against a targeted resource, where the metrics indicate instances where users were exposed to the malicious attack or instances where a cloud-based threat detection system prevented the user from being exposed to the malicious attack. The method may also include rendering a threat dashboard for a web browser application of a client device, where the threat dashboard includes the located metrics. In various embodiments, methods of dynamically detecting abnormalities in otherwise legitimate emails are provided. The methods may include determining and redetermining, using the one or more processors, one or more rules that define normal patterns in a number of sending Top-Level Domains of received emails.