Anomaly Discovery

This is the help text the console shows in the help panel on this page.

Anomaly & AI Discovery

Anomalies are access irregularities found during your access audits by AutoCISO’s AI analysis — such as accounts that don’t match any known employee, terminated users who still have access, or privileges nobody has re-verified. These findings may not appear in the official data your systems export.

Current view and history

By default the report lists only open findings: anomalies from each asset’s most recent audit, one row per person, asset and type. A finding drops out when a later audit of the asset no longer shows it, or when its remediation task is closed after the finding was seen. Turn on Show history to see every earlier finding with a Status column: Open, Resolved (remediation closed after it was seen) or No longer seen (a later audit no longer shows it). The stat cards always count open findings.

Severity Levels

• Critical: Immediate action required. Typically terminated employees with active privileged access.
• High: Significant risk requiring prompt review.
• Medium/Low: Informational findings that should be reviewed in the next cycle.

The stat cards show Total Anomalies, Critical, High and Medium / Low.

Data Table

Each anomaly shows the affected Identity, Asset, Type, Severity, Risk score and Discovered date. The table is sorted by risk score, highest first.

Anomaly Types

• GHOST_ACCOUNT: An account in an asset with no matching identity in the employee directory.
• TERMINATED_ACCESS: An account belonging to an employee with TERMINATED status.
• DORMANT_ACCESS: An account with no recent activity.
• STALE_PRIVILEGE: A privilege that has not been re-verified within the review cycle.

Export

Use CSV or PDF to include anomaly findings in audit packages or executive risk reports. CSV exports the rows on screen; PDF always exports the open findings.