Under Settings → Notifications choose, for each trigger, whether you get it in the app (the bell), by email or both.
Always sent
Security notices are always emailed to you: MFA turned off, password changed, an account lock, and a sign-in from a browser and network not seen on your account before (your first sign-in only records the device). A change of email address is always announced to the old address.
Daily digest
One email per organization per day, at the hour you pick in the organization's time zone (Settings → Organization). It lists new findings by severity, monitoring events, completed scans and assets awaiting verification for the previous 24 hours. Nothing is sent on a quiet day. It is off by default and each member opts in for themselves.
Send alerts elsewhere
Alerts can also go to Slack, Microsoft Teams, PagerDuty, a signed webhook, Jira or GitHub issues. See Integrations, API tokens and webhooks.