Low to critical, updating continuously, always traceable to the exact actions that raised it and their weights. Holds up in an investigation or a legal dispute — never an opaque number.
Each person compared against their own history, not one blanket rule, with off-hours activity weighted heavier. This is what keeps false positives low enough that the team never switches it off.
A blocked AI paste, unusual hours, an out-of-role access request — three siloed monitors would each shrug. Cyfriq files them as one story about one person, near the top of the list.
High risk quietly asks that person for extra proof of identity and tightens data rules on their next sensitive action, and passes the alert to the security tools you already run — while everyone else's day is completely unaffected.
Three years of 9-to-7. Then bulk downloads at 2am.
An accountant who hasn't logged in after 7pm in three years starts bulk-downloading at 2am. Their risk level climbs on the spot; the next sensitive download is challenged for extra proof; they move to the top of the security team's list — and 2,000 colleagues notice nothing.
See it on your own network.
A 14-day pilot with success criteria you set. First findings in 7 days — yours to keep either way.