Anomaly detection: Anomaly detection is the automated flagging of data points or events that do not fit the normal pattern: a purchase in an unusual place, an expense claim twice the usual size. It powers fraud alerts, security monitoring, and equipment warnings.
Every system has a normal: typical order sizes, usual login hours, the vibration a healthy motor produces, the number of returns a store sees in a week. Anomaly detection builds a model of that normal and raises a flag when something falls outside it. Because true anomalies are rare and usually unlabeled, most approaches are unsupervised: statistical thresholds, clustering, isolation forests, or neural networks that learn to reconstruct normal data and struggle with anything else.
You already meet it as a consumer when your card gets declined on vacation or your bank texts about a login from a new device. At work it runs inside security tools watching network traffic, cloud dashboards watching latency, audit software scanning journal entries for round numbers and weekend postings, and sensors on factory equipment.
The whole game is the trade-off between false alarms and misses. Set the threshold tight and the team drowns in alerts and starts ignoring them; set it loose and the real fraud slips through. Good deployments tune thresholds by category, let reviewers mark alerts as real or noise so the model improves, and revisit what "normal" means after the business changes. An anomaly is a reason to look, not a verdict.
Example at work
A controller at a distribution company turns on anomaly detection in the expense system. In the first month it flags a manager whose mileage claims are always the same round number, a vendor being paid from two different cost centers, and a Sunday journal entry. Two are innocent, one is not. She adjusts the mileage rule so honest round numbers stop triggering it.
Why it matters
Anomaly detection is the quiet workhorse behind fraud prevention, uptime, and audit. Understanding that it flags the unusual rather than the wrong helps you set thresholds sensibly and treat alerts as leads to investigate.
Related terms
- Unsupervised learningUnsupervised learning is machine learning on data with no correct answers attached. The model finds structure on its own, grouping similar customers, spotting unusual transactions, or clustering tickets by topic; a human then decides what the groups mean.
- Machine learning (ML)Machine learning is the branch of AI in which software learns patterns from examples instead of following rules a programmer wrote by hand. Nearly every modern AI tool, including chat assistants, is built on it.
- Predictive analyticsPredictive analytics uses historical data and machine learning models to estimate how likely a future outcome is: which customers will churn, which invoices will be paid late, what a store will sell next month. The output is a probability, not a fact.
- Human-in-the-loopHuman-in-the-loop is a design approach in which a person reviews, approves, or corrects an AI system's output at defined points before it takes effect, combining the speed of automation with human judgment and accountability.
- Ground truthGround truth is the verified, correct answer that an AI system's output is compared against, such as a human-labeled dataset or a confirmed real-world outcome. It is the reference standard used to train models and measure their accuracy.