Episode 230: Detecting One Bad Access Among Billions

Google’s Facade uses deep contextual anomaly detection to find suspicious insider activity hiding among billions of legitimate access events. Trained only on normal historical activity, it compares what a person accesses with their role, peers, and past behavior, achieving false-positive rates below 0.01% in Google’s evaluation. How does it work? Where does it fall short? Can the approach extend beyond employees to agentic AI?

#Speakers

• Host: Mike Schwartz, Founder/CEO Gluu
• Co-Host: Rohit Khare, Product Manager & Software Architect • Simplifying Security
• Guest: Casper Neo, Founder and CEO, Palace Cybersecurity

#Homework

• White Paper: Facade: High-Precision Insider Threat Detection Using Deep Contextual Anomaly Detection
• Blackhat 2025 presentation
• Facade Github

#Takeaways

• An allowed action on a resource can still lack a business justification. Facade targets abuse of existing permissions, including access to sensitive information outside an employee’s work.
• Coworker relationships help explain resource access. Facade compares who an employee works with against who previously accessed a resource. A first-time access may be reasonable when their peers already work with it.
• One sensitive access can matter. Volume-based detection can miss someone taking a single valuable document. Facade scores individual accesses and combines suspicious activity to prioritize investigations.
• LLMs fit better after detection. Casper described Facade as much cheaper for continuous monitoring. LLMs can then enrich flagged activity, investigate context, and help ask employees for business justification.
• Agent detection needs better telemetry and a credible baseline. Agents using a person’s account can be evaluated against that person’s history. Independent agents need different features—and reliable records of what they do and whose authority they use.