Every security vendor now sells anomaly detection with AI in the name. Some of it is new. A good deal of it is a statistical baseline with better marketing, and telling the two apart is worth money to anyone signing the contract.
Three things, whatever the label says
Nearly all of it computes the same three. What normal looks like for this specific customer, user, or device. How far the current behavior sits from that normal. Whether the distance is far enough to act on.
A baseline, a deviation, and a threshold. Modern systems may build the baseline in more dimensions and update it faster. The shape of the answer has not changed.
Ask a vendor to describe it in those terms. A good one will explain how their baseline is built and where the threshold comes from. A weak one will say the model learns.
The system we built in the late 1980s
I worked at a consulting firm that built fraud detection for phone cards. The client sold the cards, people used them, and some of those people were not the people who bought them.
My idea was to give every customer a profile describing what normal looked like for that person. Where they called from, when, how often, for how long.
Then every call got measured against that profile using standard deviation. Not a rule saying calls from Guatemala are suspicious, because plenty of legitimate customers call from Guatemala. A measure of how unusual this call was for this particular person.
A man who lives in Florida makes several calls from Guatemala at two in the morning. Outside his profile, but within tolerance, because he might be on vacation.
Then a call comes in from New Orleans. Now the pattern is not just unusual, it is impossible, because a person cannot be in both places. The flags accumulate and the card gets cut off.
No model, no training run
It had a profile per customer, a deviation measure, and a threshold. It caught fraud, the client was happy, and the firm turned it into a product.
I am not arguing nothing has improved since. Modern systems handle far more signals, adapt faster, and find patterns a person would not think to look for. Those are real gains.
The argument is narrower. A great deal of what gets sold as AI detection is the older method with more dimensions, priced as though it were new.
The threshold is the whole product
Set it tight and you block real customers. Every legitimate person who travels or has an unusual week becomes a support call and an angry email. Set it loose and fraud walks through.
Our design required accumulation rather than a single event. One odd call moved a number. It did not cut anyone off. The card stopped only when the pattern had built past the point where an innocent explanation still fit.
That approach is available to any company running any kind of detection today, and it has nothing to do with the technology. Decide what a single anomaly is worth, decide what the total has to reach, and write both numbers down.
Four questions for a vendor, none of them technical
What does the system compute, described without using the words AI or learning. How is normal established for a new customer with no history. What happens when the system is wrong, and who finds out. Who can change the threshold, and does that require the vendor.
A vendor with a real product answers all four in a few minutes. A vendor selling a label will move to case studies.
The last one matters more than it looks. A threshold you cannot adjust is somebody else’s risk appetite running inside your business.
Nobody called any of this intelligence in 1990, and nobody would have paid extra for the word.
The full article is on my site: https://thewritingking.com/what-anomaly-detection-computes/. It runs longer, carries the diagrams, and answers the questions readers ask most.
These are AI-made summaries of longer articles on my site, written with AI assistance from my own interviews and my own career. Nothing goes out that I have not read and approved.