Appendix

Sources for the technical reviewer

Every figure on the domain pages is a pair: the share of the known bad caught, and the share of normal activity flagged, in the published leader’s own unit, on public held-out data. A lower result on one corpus is reported there. It is not a verdict on the rest of the offering. This page names the corpora and the published figures. It says nothing about method.

Corpora of record

Page	Public corpus	Unit of the false-alarm rate
Store traffic	CIC-IDS 2017, brute force. CSIC 2010 web requests, anomalous requests.	Share of normal requests
Network, flows	CTU-13 botnet captures. CIC-IDS 2018. UNSW-NB15, second corpus, nine families.	Share of benign flows
Network, packets at line rate	220 million replayed frames.	Packets per second against gigabit line rate
Network, packet-level IoT attacks	Kitsune, nine attacks on one IoT network.	Share of held-out clean packets
Botnet traffic	N-BaIoT, nine consumer devices, Mirai and BASHLITE.	Share of benign rows
Account takeover	Los Alamos National Laboratory 2015 authentication events, about 1.05 billion.	Share of logons
Insider threat	CERT insider threat corpus.	Share of user-days
Card payment fraud	ULB European card corpus. IBM TabFormer generated card history. The fraud-detection handbook simulation.	Share of transactions
New-account fraud	Bank Account Fraud suite, NeurIPS 2022. A mobile-money corpus.	Share of applications or rows
Money laundering	A synthetic banking corpus with a laundering ring. IBM AML HI-Small generated transfers. Elliptic++, bitcoin.	Share of clean rows or transactions
Billing and claims	Medicare-shaped provider claims, provider-month. Medicare Part B and Part D public files with the exclusion list.	Share of clean providers or provider-years
Process faults	Tennessee Eastman process, 20 fault types. Petrobras 3W oil-well events.	Share of fault-free windows
Run-to-failure	NASA C-MAPSS turbofan fleets. NASA IMS bearing rigs.	Share of healthy windows or snapshots

Published leader figures quoted on the pages

Le and Zincir-Heywood, unsupervised ensembles for insider threat on the CERT corpus, IEEE Transactions on Network and Service Management, 2021. 77% at 1% of user-days.
Graph-learning lateral-movement detection on the Los Alamos 2015 events, arXiv 2504.13527, 2025. 85% at 0.9% of logons.
Zero-day detection with autoencoders and isolation forests on CIC-IDS2017, Springer, 2025. About 99% at 1.1% of flows, supervised.
Rato and Reis, dynamic PCA with decorrelated residuals on the Tennessee Eastman process, Chemometrics and Intelligent Laboratory Systems, 2013. Deep-autoencoder study, PHM Society, 2023. 85% of fault runs at 1%, supervised.
Meidan et al., N-BaIoT per-device autoencoders. About 100% at 0.7% of benign rows, label-free per device.
Jesus et al., Bank Account Fraud dataset suite, NeurIPS Datasets and Benchmarks, 2022. 50% at 5%, supervised.
Weber et al., anti-money laundering in bitcoin, the Elliptic dataset, KDD Workshop on Anomaly Detection in Finance, 2019. About 68% at 0.17%, random forest, temporal split. Elmougy and Liu, Elliptic++, KDD 2023.
Bauder and Khoshgoftaar, Medicare Part B fraud detection with exclusion-list labels, Journal of Big Data, 2019. Provider claims corpus best cited F1 about 0.6, about 65% at about 5%, supervised.
Card fraud leaders: ULB corpus best cited area under the precision-recall curve about 0.85. IBM TabFormer F1 0.86. IBM AML HI-Small minority F1 64.6%. 3W per-class F1 0.7 to 0.9. UNSW-NB15 accuracy 0.85 to 0.99, no false-alarm rate published.
Surveys: SANS Detection and Response Survey, 2025. Microsoft and Omdia, State of the SOC, 2026. EEMUA 191 and published plant alarm surveys.

Protocol

Every figure of ours is a held-out read: the share caught and the share of ordinary activity marked are reported as a pair on held-out public data, in the published comparison’s own unit. Where a figure is “with examples,” the service was handed the same labelled examples the leader used, and that is stated beside it. Figures of record: 15 September 2026 and 26 September 2026.