Knowing what a product computes tells you whether the price is for the math or for the label.
Every security vendor now sells anomaly detection with AI in the name. Some of it is new. A good deal of it is a statistical baseline with better marketing, and telling the two apart is worth money to anyone signing the contract.
What does AI anomaly detection compute?
Nearly all of it computes the same three things.
First, what normal looks like for this specific customer, user, or device. Second, how far the current behavior sits from that normal. Third, whether the distance is far enough to act on.
That’s a baseline, a deviation, and a threshold. Modern systems may build the baseline in more dimensions and update it faster than older ones did. The shape of the answer hasn’t changed.
Ask a vendor to describe it in those terms and watch what happens. A good vendor will explain how their baseline is built and where the threshold comes from. A weak one will say the model learns.
What is a behavioral baseline in fraud detection?
In the late 1980s I worked at a consulting firm that built a fraud detection system for phone cards. The client sold the cards, people used them, and some of those people weren’t the people who bought them.
My idea was to give every customer a profile. The profile described what normal looked like for that person. Where they called from. When they called. How often, and for how long.
Then every call got measured against that profile using standard deviation. Not a rule that said calls from Guatemala are suspicious, because plenty of legitimate customers call from Guatemala. A measure of how unusual this call was for this particular person.
A man who lives in Florida makes several calls from Guatemala at two in the morning. That sits outside his profile. It’s not proof of anything, because he might be on vacation.
Then a call comes in from New Orleans. Now the pattern isn’t just unusual, it’s impossible, because a person cannot be in both places. The flags accumulate and the card gets cut off.
Now the pattern is not just unusual, it is impossible, because a person cannot be in both places.Share on X
Can statistics do what machine learning claims to do?
For this class of problem, yes, and it did.
The system had no model and no training run. It had a profile per customer, a deviation measure, and a threshold. It caught fraud, the client was happy, and the firm turned it into a product.
I’m not arguing that nothing has improved since. Modern systems handle far more signals, adapt faster, and find patterns a person wouldn’t think to look for. Those are real gains.
The argument is narrower. A great deal of what gets sold as AI detection is the older method with more dimensions, and it’s priced as though it were new. Knowing which one you’re buying changes the negotiation.
How do you set the threshold for a fraud alert?
The threshold is the entire product and it’s where most systems fail.
Set it tight and you block real customers. Every legitimate person who travels, changes habits, or has an unusual week becomes a support call and an angry email. Set it loose and fraud walks through.
Our design handled this by requiring accumulation instead of a single event. One odd call moved a number. It didn’t cut anyone off. The card stopped only when the pattern had built past the point where an innocent explanation still fit.
That approach is available to any small company running any kind of detection today, and it’s nothing to do with the technology. Decide what a single anomaly is worth, decide what the total has to reach, and write both numbers down.
If a vendor cannot tell you where their threshold sits and who can change it, that’s the answer to whether you should buy it.
What questions should you ask an AI security vendor?
Four, and none of them are technical.
What does the system compute, described without using the words AI or learning. How’s normal established for a new customer who has no history yet. What happens when the system is wrong, and who finds out. Who can change the threshold, and does that require the vendor.
A vendor with a real product answers all four in a few minutes. A vendor selling a label will move to case studies.
The last question matters more than it looks. A threshold you cannot adjust is somebody else’s risk appetite running inside your business.
What happens when one person is the only one who understands the system?
The code base was built by a man named Tom, and Tom was a genius. I came up with the profile and deviation concept, and he built the thing. He probably did the majority of the design as well.
Tom was Croatian, and during that period he’d occasionally leave for a week to help with a freedom movement back home. Little notice. He’d tell us he was going, and then he was gone.
Managing a project where the one person who understood the code could vanish for a week wasn’t the disaster it looks like from outside. It happened twice during that project, we built the time into the schedule, and the work got done.
What made it survivable was that the absences were known and not surprises. A dependency you’ve planned for is a scheduling fact. The same dependency unplanned is an emergency.
Most small companies have a Tom. The mistake isn’t having one, because a small company cannot avoid it. The mistake is pretending you don’t.
What did the phone card project prove about new technology?
The phone card system came out well. Good product, happy client, and the firm sold it afterward.
What stayed with me was how ordinary the core idea turned out to be. Know what normal looks like for each individual. Measure how far the current behavior sits from it. Act when the distance is far enough.
Nobody called that intelligence in 1990 and nobody would have paid extra for the word.
When a vendor describes something you cannot follow, ask what it computes. Sometimes the answer is new. Often it’s a baseline, a deviation, and a threshold, which is worth buying at the right price and not at any price.