# Anomaly Discovery
URL: https://docs.autociso.io/console/ciso-reports/anomaly-discovery/
Description: Anomalies are access irregularities found during your access audits by AutoCISO's AI analysis — such as accounts that don't match any known employee, terminated users who still have access, or privileges nobody has…

*This is the help text the console shows in the help panel on this page.*

## Anomaly & AI Discovery

Anomalies are access irregularities found during your [access audits](https://docs.autociso.io/console/access/access-audit/) by AutoCISO's AI analysis — such as accounts that [don't match any known employee](https://docs.autociso.io/product/access/correct-employee-match/), [terminated users who still have access](https://docs.autociso.io/console/ciso-reports/offboarding-violations/), or privileges nobody has re-verified. These findings may not appear in the official data your systems export.

### Current view and history
By default the report lists only **open** findings: anomalies from each asset's most recent audit, one row per person, asset and type. A finding drops out when a later audit of the asset no longer shows it, or when its remediation task is closed after the finding was seen. Turn on **Show history** to see every earlier finding with a **Status** column: **Open**, **Resolved** (remediation closed after it was seen) or **No longer seen** (a later audit no longer shows it). The stat cards always count open findings.

### Severity Levels
- **Critical**: Immediate action required. Typically terminated employees with active privileged access.
- **High**: Significant risk requiring prompt review.
- **Medium/Low**: Informational findings that should be reviewed in the next cycle.

The stat cards show **Total Anomalies**, **Critical**, **High** and **Medium / Low**.

### Data Table
Each anomaly shows the affected **Identity**, **Asset**, **Type**, **Severity**, **Risk** score and **Discovered** date. The table is sorted by risk score, highest first.

### Anomaly Types
- **GHOST_ACCOUNT**: An account in an asset with no matching identity in the [employee directory](https://docs.autociso.io/console/directory/employees/).
- **TERMINATED_ACCESS**: An account belonging to an employee with `TERMINATED` status.
- **DORMANT_ACCESS**: [An account with no recent activity](https://docs.autociso.io/console/ciso-reports/stale-accounts/).
- **STALE_PRIVILEGE**: A privilege that has not been re-verified within the review cycle.

### Export
Use **CSV** or **PDF** to include anomaly findings in audit packages or executive risk reports. **CSV** exports the rows on screen; **PDF** always exports the open findings.