Skip to content
NNSEC

Service 08

Zero-Day
& Anomaly Detection

UEBA and statistical baselines across identity, cloud APIs, and endpoints — catch zero-days and insider patterns rules miss.

Anomaly detection combines UEBA and statistical baselines across identity, cloud control plane, and endpoints — catching insider patterns and zero-day behaviors static rules miss. Every alert includes explainable features and raw events; analyst feedback improves models weekly instead of black-box scores alone.

Entity risk score

ML confidence 0.94 · svc_backup

8.4k

Entities modeled

0.94

ML confidence

15

New rules / mo

Intel

[ WHO IT IS FOR ]

Teams with identity-heavy risk, AI/ML infrastructure, or GDPR-sensitive workforces needing behavioral monitoring beyond signature detections.

[ OPERATING CADENCE ]

30-day baseline per entity, weekly model feedback review, monthly promotion of stable patterns to deterministic rules.

[ 08.0 // CHALLENGES ]

Problems this
service line solves.

Why teams add this line to the retainer instead of stretching a generic MSSP or point tool.

  • Rules that cannot see API-key abuse or impossible travel
  • Insider cases discovered only after data leaves
  • ML alerts analysts cannot defend to regulators
  • Cold-start noise after rapid hiring or acquisitions
[ 08.1 // DELIVERABLES ]

What's included
in the retainer.

Concrete outputs — not vague 'assessment' language.

Behavior baselines

Per-user and per-service normalcy models.

Anomaly scoring

Risk score with explainable features.

Peer groups

Compare role-based cohorts for drift.

Insider risk

Data exfil and privilege escalation patterns.

Cloud API anomalies

Impossible travel on control plane keys.

Feedback loop

Analyst labels improve models weekly.

[ 08.2 // PROCESS ]

How it works
in five steps.

Discovery through operate — same cadence across all nine service lines.

01

Ingest

Identity, EDR, and cloud audit logs.

02

Train

30-day baseline per entity.

03

Detect

Score anomalies above adaptive threshold.

04

Investigate

NorthSec AI narrative with feature importances.

05

Harden

Promote stable patterns to deterministic rules.

[ 08.3 // PLATFORM ]

NorthSec AI
advantage.

UEBA charts highlight anomaly spikes with confidence overlays — analysts see why a score fired.

Platform overview

Entity risk score

ML confidence 0.94 · svc_backup

[ 08.4 // COMPLIANCE ]

Control mapping
built in.

Sample mappings — full library expands per tenant frameworks.

CC7.2 Monitoring

SOC 2

A.8.16 Event logging

ISO 27001

GDPR Art. 32

GDPR

[ 08.5 // TIERS ]

Included by tier

TierThis service
foundation · $3,500/mo
growth · $5,000/mo
scale · $8,000/mo
enterprise · $12,000/mo

☑ included · ▲ add-on · ☒ not in tier

Customer outcome

Insider case in 4h

AI company detected abnormal model-repo access before weights exfiltrated.

AI / ML · anonymized

FAQ

We provide feature contributions and raw events for every alert.

Ready to scope anomalies?