AI Anomaly Detection in Plain Terms
AI anomaly detection is the use of machine learning to spot activity that deviates from a system’s normal behaviour. Rather than matching known attack signatures, it learns what normal looks like across your network, users and devices, then flags the unusual for investigation. This lets it catch threats that no signature has ever described.
That distinction matters because the attacks that hurt most are the ones your existing tools have never seen. A signature-based firewall or antivirus can only block what it already recognises. Anomaly detection works the other way round.
It knows your environment well enough to notice when something does not belong, whether that is a login at an odd hour, a server talking to a country it never contacts or a user copying files they have never touched.
For a Swedish organisation the timing is not academic. “Cybersäkerhetslagen, in force since 15 January 2026″, transposes the NIS2 risk-management duty (Article 21) into Swedish law. That duty expects continuous monitoring and anomaly detection is a direct way to meet it.
How AI Anomaly Detection Works
AI anomaly detection works in two phases. First it learns a baseline, a statistical picture of what normal activity looks like for your specific environment over days or weeks. Then it scores live activity against that baseline and raises the events that sit far enough outside it.
The learning is where the AI earns its place. A modern environment produces far too much data for a person or a fixed rule to model. Machine learning can hold thousands of variables at once, from login times and data volumes to which systems normally talk to each other and build a picture of normal that no one could write down by hand.
Most security anomaly detection is unsupervised, meaning the model learns from your data without anyone labelling what is good or bad in advance. That suits security well because real attacks are rare and rarely labelled. The model learns the shape of normal and treats sharp departures from it as suspicious.
This became practical only recently for three reasons. Compute and storage grew cheap enough to analyse everything rather than a sample. The tooling matured and no longer needs a dedicated data-science team to run. And attackers shifted to techniques that slip past signatures which turned behaviour-based detection from optional into necessary.
Types of AI Anomaly Detection
Anomaly detection is not one method. It varies along three lines. The kind of anomaly it looks for, how the model learns and where in your environment it watches.
Security teams borrow a taxonomy from data science, set out in a widely cited 2009 survey by Chandola, Banerjee and Kumar. It sorts anomalies into three kinds.
- Point anomalies: A single event that is odd on its own such as one payment far larger than any before it.
- Contextual anomalies: An event that is normal in one context and odd in another such as a login that is fine at 9am but suspicious at 3am.
- Collective anomalies: A set of events that looks fine individually but forms a suspicious pattern together such as a slow steady trickle of data leaving the network.
The models also differ in how they learn what normal means.
- Unsupervised: Learns from your raw data with no labels. The most common approach in security, because attacks are rare and rarely tagged in advance.
- Supervised: Trained on examples already labelled normal or malicious. Accurate when good labels exist, which in security they often do not.
- Semi-supervised: Trained only on normal activity, then treats anything unlike it as suspect. A practical middle ground.
Finally, anomaly detection is applied at different layers and most mature setups combine them.
- Network anomaly detection: Watches traffic for unusual connections, volumes or destinations. Often sold as network detection and response, or NDR.
- User and entity behaviour analytics (UEBA): Learns how each person and system normally behaves and flags accounts acting out of character.
- Log and endpoint analytics: Feeds device and system logs, often through a SIEM, to spot odd sequences of events.
Why AI Anomaly Detection Matters
The case for anomaly detection is speed. The longer an attacker stays undetected, the more they steal, encrypt or break and the more it costs to clean up.
IBM’s Cost of a Data Breach Report 2024 put the global average cost of a breach at 4.88 million dollars. The same study found that organisations using security AI and automation extensively spent on average 2.22 million dollars less per breach than those that did not, the largest saving of any factor IBM measured. It also recorded the average time to identify and contain a breach at about 258 days.
Dwell time, the number of days an intruder goes unnoticed, has been falling. Mandiant’s M-Trends 2024 reported a global median of 10 days in 2023, a record low. Some of that gain is uncomfortable because ransomware announces itself quickly and drags the median down. The quieter intrusions, the ones anomaly detection exists to catch, can still run for months.
There is a Swedish version of this risk. In August 2025 a ransomware attack on the supplier Miljödata disrupted services across roughly 200 of Sweden’s 290 municipalities. When one supplier can reach that many organisations, the ability to notice unusual behaviour on a partner connection stops being a technical nicety.
AI Anomaly Detection in the Real World
Two well-documented incidents frame what anomaly detection is worth. One shows it catching an attack nothing else could. The other shows what a missed alert costs.
The SolarWinds Attack, 2020
In 2020 attackers compromised Orion, a widely used IT-management product from the software company SolarWinds, and used a tainted update to push a hidden backdoor to thousands of organisations. The operation was later attributed to a nation-state and had evaded the signature-based defences everywhere it landed.
It came to light through a single behavioural anomaly. A security team reviewing its own environment found that an extra device had been registered to an employee’s multifactor authentication, something the employee had not done. That one oddity did not match the person’s normal pattern so they investigated and the investigation exposed the entire supply-chain campaign. Public disclosures followed in December 2020.
Nothing on a signature list would have flagged a legitimate, signed software update. Only watching behaviour and questioning a login that did not fit, surfaced it. The control here is behavioural anomaly detection on identity and access.
The Target Breach, 2013
The 2013 breach of the US retailer Target is the counter-example. Over the weeks around Black Friday, attackers who had entered through a heating and ventilation contractor installed malware on Target’s checkout systems and began harvesting card data.
Target’s monitoring tools did their job. They generated alerts on the malicious activity. The problem sat on the other side of the screen. The alerts were not acted upon and the theft continued. About 40 million payment card records and around 70 million customer records were exposed.
A US Senate committee report in March 2014 set out the sequence in detail. The lesson is blunt. Detection that no one answers is the same as no detection at all which is why a monitored alert needs a team ready to act on it around the clock.
AI Anomaly Detection and Compliance
For Swedish organisations, anomaly detection is not only good practice. It helps meet duties that now carry legal weight.
NIS2, the EU directive on network and information security, requires essential and important entities to run continuous monitoring and to detect and handle incidents, under Article 21. In Sweden it applies through Cybersäkerhetslagen (SFS 2025:1506), in force since 15 January 2026. Anomaly detection is one of the clearest ways to satisfy the risk-management and monitoring duties in Article 21 and the incident-handling expectation in Article 21.2b.
The law also sets a reporting clock to MCF (formerly MSB) and your sector authority. You have 24 hours to send an early warning, 72 hours for a full notification and one month for a final report. You cannot report what you have not detected, so fast detection is what makes those deadlines survivable. Under Article 20 boards are accountable for getting this right.
Financial entities carry a parallel duty. DORA, in force across the EU, requires ICT incident management under Article 17, supervised in Sweden by Finansinspektionen. The detection and classification of anomalies feeds directly into it.
Where a breach touches personal data, GDPR Article 33 adds its own 72 hour notification to IMY, the Swedish data protection authority. Again the clock starts at detection.
One point cuts the other way. The tool doing the detecting is itself an AI system. Security AI generally falls outside the EU AI Act’s high risk categories, though the classification depends on use (an AI system acting as a safety component of critical infrastructure can be in scope). Either way you remain accountable for the decisions it makes on your behalf, so it needs oversight like any other control.
Strengths and Limits of AI Anomaly Detection
Anomaly detection is powerful but it is not magic, and buying it without understanding its limits is how organisations end up disappointed.
Its strength is real. Because it judges behaviour rather than matching a known signature, it can catch brand-new malware, a compromised insider or a novel technique that no blocklist has ever heard of. That is exactly the category of attack that does the most damage.
The limits are just as real.
- False positives: A model that flags too much creates alert fatigue and a flood of low-value alerts is how a genuine one gets missed.
- Evasion: A patient attacker who uses your own legitimate tools, a technique called living off the land, and moves slowly and quietly can stay inside the baseline of normal and avoid tripping the model.
- Concept drift: Normal changes. A new application, a reorganisation or a busy season shifts the baseline, and a model that is not retrained slowly loses its accuracy.
The most important limit is conceptual. Anomaly detection produces signals, not verdicts. It tells you that something is unusual. Whether that unusual thing is a real threat is a separate judgment and a person still has to look, decide and respond. On its own the technology is an alarm with no one listening. The value lives in the tuning and the response wrapped around it.
How to Deploy AI Anomaly Detection Well
If you take one thing into a buying decision, take this. Anomaly detection is only as good as the baseline it learns and the response it triggers. Treat it as a combination of people, process and technology rather than a product you switch on and forget.
- Baseline your real environment first: Let the model learn from weeks of your actual traffic before you trust its alerts. A baseline built on too little data flags everything or nothing.
- Feed it context from every layer: Network, identity, endpoint and log data together let the model see a pattern that any single source would miss.
- Tune relentlessly to cut false positives: An untuned model buries real alerts under noise, and a buried alert is one no one answers, which is the failure that let the Target theft run.
- Route alerts to people who can act, at any hour: A signal at 3 am is worthless if no one triages it until Monday. This is why many organisations use a managed detection and response service rather than staffing a round-the-clock team themselves.
- Retrain as your environment changes: Revisit the baseline after any major change so concept drift does not quietly erode your coverage.
Done well, anomaly detection is the difference between finding an intruder in hours and finding out from a customer, a regulator or a ransom note months later. For most Swedish organisations the practical route to it is a monitored service that pairs the detection engine with a Sweden-based team to answer it which is what eBuilder’s Managed Detection and Response is built to do.
