Service 08
Zero-Day
& Anomaly Detection
UEBA and statistical baselines across identity, cloud APIs, and endpoints — catch zero-days and insider patterns rules miss.
Anomaly detection combines UEBA and statistical baselines across identity, cloud control plane, and endpoints — catching insider patterns and zero-day behaviors static rules miss. Every alert includes explainable features and raw events; analyst feedback improves models weekly instead of black-box scores alone.
Entity risk score
ML confidence 0.94 · svc_backup
8.4k
Entities modeled
0.94
ML confidence
15
New rules / mo
[ WHO IT IS FOR ]
Teams with identity-heavy risk, AI/ML infrastructure, or GDPR-sensitive workforces needing behavioral monitoring beyond signature detections.
[ OPERATING CADENCE ]
30-day baseline per entity, weekly model feedback review, monthly promotion of stable patterns to deterministic rules.
Problems this
service line solves.
Why teams add this line to the retainer instead of stretching a generic MSSP or point tool.
- ◆Rules that cannot see API-key abuse or impossible travel
- ◆Insider cases discovered only after data leaves
- ◆ML alerts analysts cannot defend to regulators
- ◆Cold-start noise after rapid hiring or acquisitions
What's included
in the retainer.
Concrete outputs — not vague 'assessment' language.
Behavior baselines
Per-user and per-service normalcy models.
Anomaly scoring
Risk score with explainable features.
Peer groups
Compare role-based cohorts for drift.
Insider risk
Data exfil and privilege escalation patterns.
Cloud API anomalies
Impossible travel on control plane keys.
Feedback loop
Analyst labels improve models weekly.
How it works
in five steps.
Discovery through operate — same cadence across all nine service lines.
01
Ingest
Identity, EDR, and cloud audit logs.
02
Train
30-day baseline per entity.
03
Detect
Score anomalies above adaptive threshold.
04
Investigate
NorthSec AI narrative with feature importances.
05
Harden
Promote stable patterns to deterministic rules.
[ 08.3 // PLATFORM ]
NorthSec AI
advantage.
UEBA charts highlight anomaly spikes with confidence overlays — analysts see why a score fired.
Platform overviewEntity risk score
ML confidence 0.94 · svc_backup
Control mapping
built in.
Sample mappings — full library expands per tenant frameworks.
CC7.2 Monitoring
SOC 2
A.8.16 Event logging
ISO 27001
GDPR Art. 32
GDPR
[ 08.5 // TIERS ]
Included by tier
| Tier | This service |
|---|---|
| foundation · $3,500/mo | ☒ |
| growth · $5,000/mo | ▲ |
| scale · $8,000/mo | ☑ |
| enterprise · $12,000/mo | ☑ |
☑ included · ▲ add-on · ☒ not in tier
Customer outcome
Insider case in 4h
AI company detected abnormal model-repo access before weights exfiltrated.
AI / ML · anonymized
FAQ
We provide feature contributions and raw events for every alert.