Use case 06
Insider and privileged control anomalies
Privileged actions outside their established pattern.
- Anomaly
- change_limits at 02:30 UTC from syn_ws_unknown
- History
- 60 established privileged actions, office hours, one workstation
- Privilege
- 80 · PRIVILEGED_ACTION_OUTSIDE_HOURS, PRIVILEGED_ACTION_NEW_FUNCTION, PRIVILEGED_ACTION_NEW_DEVICE
- Auth topology
- 40 · AUTH_FACTOR_SHARED_BY_PRIVILEGED_USERS
- Approvers
- 50 · APPROVERS_SHARE_INFRASTRUCTURE
- APPROVERS_SHARE_INFRASTRUCTURE
- AUTH_FACTOR_SHARED_BY_PRIVILEGED_USERS
- PRIVILEGED_ACTION_NEW_DEVICE
- PRIVILEGED_ACTION_NEW_FUNCTION
- PRIVILEGED_ACTION_OUTSIDE_HOURS
control_risk is not part of a transaction decision; it is assessed per principal and reported. Nothing was acted on.
The problem
Limit changes, approvals and configuration edits by staff are a fraud surface that transaction monitoring ignores. The signals are behavioural: a person acting outside their own established hours, functions and devices, or two approvers who turn out to share one factor.
How Cenvoriq approaches it
ControlGraph is a detector library fed by the institution's control events. It produces Control Risk as a review signal for the institution's own security or audit function.
Status in the current release
Built and tested; shown in demo scenario E. Control Risk is not part of a transaction decision and no action model exists for principals: the output is a review signal.
- Privileged action outside established hours
- Privileged function or device never used by this principal
- Authentication factor shared by privileged principals
- Approvers sharing infrastructure
Deployment
Measured in SHADOW before it touches a payment
A design partner replays its own tokenised history first, then mirrors a live stream. The engine scores this pattern and records the recommendation; the applied action is always allow and the institution’s own systems keep every control.