A method for providing a threat dashboard (1200, 1300) via a cloud-based threat detection system, the cloud-based threat detection system comprising a Central Processing Unit, CPU and a memory, the method comprising the steps of: receiving, at the cloud-based threat detection system, a message from a sender server; analyzing (1005, 1110), via the cloud-based threat detection system, before the message is delivered to an email server, a link included in the message to determine if the link is associated with a potentially malicious resource, the message received from the sender server; replacing (1010, 1115) the analyzed link with an alternate link to a trusted resource if the analyzed link is associated with the potentially malicious resource; locating metrics regarding a malicious attack against a targeted resource, the metrics indicating instances where users were exposed to the malicious attack, instances where the cloud-based threat detection system prevented the users from being exposed to the malicious attack, instances where the users actuated the malicious attack, and instances where the cloud-based threat detection system prevented the malicious attack from being actuated; and rendering a threat dashboard (1200, 1300) for a web browser application of a client device, the threat dashboard (1200, 1300) comprising the located metrics, the rendering including graphing a timeline comprising a graph having a horizontal axis defined by a period of time of the metrics and a vertical axis defined by the instances where the cloud-based threat detection system prevented the users from being exposed to the malicious attack and the instances where the users were exposed to the malicious attack; the rendering further including graphing another timeline comprising another graph having a horizontal axis defined by a period of time of the metrics and a vertical axis defined by the instances where the cloud-based threat detection system prevented the malicious attack from being actuated and the instances where the users actuated the malicious attack. receiving, at the cloud-based threat detection system, a message from a sender server; analyzing (1005, 1110), via the cloud-based threat detection system, before the message is delivered to an email server, a link included in the message to determine if the link is associated with a potentially malicious resource, the message received from the sender server; replacing (1010, 1115) the analyzed link with an alternate link to a trusted resource if the analyzed link is associated with the potentially malicious resource; locating metrics regarding a malicious attack against a targeted resource, the metrics indicating instances where users were exposed to the malicious attack, instances where the cloud-based threat detection system prevented the users from being exposed to the malicious attack, instances where the users actuated the malicious attack, and instances where the cloud-based threat detection system prevented the malicious attack from being actuated; and rendering a threat dashboard (1200, 1300) for a web browser application of a client device, the threat dashboard (1200, 1300) comprising the located metrics, the rendering including graphing a timeline comprising a graph having a horizontal axis defined by a period of time of the metrics and a vertical axis defined by the instances where the cloud-based threat detection system prevented the users from being exposed to the malicious attack and the instances where the users were exposed to the malicious attack; the rendering further including graphing another timeline comprising another graph having a horizontal axis defined by a period of time of the metrics and a vertical axis defined by the instances where the cloud-based threat detection system prevented the malicious attack from being actuated and the instances where the users actuated the malicious attack.