Low to critical, updating continuously, always traceable to the exact actions that raised it and their weights. Holds up in an investigation or a legal dispute — never an opaque number.
Each person compared against their own history, not one blanket rule, with off-hours activity weighted heavier. This is what keeps false positives low enough that the team never switches it off.
A blocked AI paste, unusual hours, an out-of-role access request — three siloed monitors would each shrug. Cyfriq files them as one story about one person, near the top of the list.
High risk triggers step-up authentication and tighter data rules on that person's next sensitive action, and exports the signal to the stack you already run — while everyone else's day is completely unaffected.
Three years of 9-to-7. Then bulk downloads at 2am.
An accountant who hasn't logged in after 7pm in three years starts bulk-downloading at 2am. Their risk level climbs on the spot; the next sensitive download is challenged for extra proof; they move to the top of the security team's list — and 2,000 colleagues notice nothing.
See it on your own network.
A 14-day pilot with success criteria you set. First findings in 7 days — yours to keep either way.