Every fact knows where it came from, and when it runs out.
- A source, so an analyst can see why something counted as normal.
- A confidence that falls when the pattern changes.
- An expiry date, so last year's normal can't excuse today's attack.
Four ways a fact gets in.
Some facts you tell us once. Most we keep current without asking you anything.
- Once, then on change
Declared
From Groundwork, Policy Kit and your portal: crown jewels, roles, change windows, approved tools and who we call.
- Daily
Synced
Pulled from your systems: users, groups and admins, devices and their owners, booked changes, joiners and leavers.
- Nightly
Learned
Summarised from 30 to 90 days of logs: who runs what, where, from which device and when, and how rare each pattern is.
- As it happens
Confirmed
Every closed verdict writes its outcome back. So does every "Was this you?" answer and every approved change.
New isn't normal. Nothing stays normal forever.
Normal goes stale fast. These rules stop Known Normal from excusing an attack, old or new.
Where the lines sit decides who looks at what.
Verdict gives every alert a chance of being an attack. Two lines split them into close quietly, ask and review, or escalate now. Move them and see what changes.
We set the lines for each customer and show you where they sit. Crown jewels and admin activity always use stricter ones.
When Verdict says 90%, about 90% should be real.
A score is only useful if it's honest. Every month we compare Verdict's scores with what alerts turned out to be, in your environment, and retune when it drifts. The result is in your monthly report.
- Every alert gets a verdict, not just the high-severity ones. Real incidents hide in the low ones too.
- Misses found in reviews or Fire Drills move the lines and the model.
What security teams ask us about it.
- Can an attacker teach it that bad behaviour is normal?
- Not quietly. New things stay new until a person confirms them, and anything touching a crown jewel or an admin account always needs a person. Slow changes still have to pass the same checks.
- Is AI making decisions about my business?
- A decision model scores the evidence and shows its reasons. An LLM only writes the explanation. People approve anything serious, and automatic actions stay within limits you set.
- What does Known Normal hold?
- Records about people, devices, servers, apps and scripts, built from identity, device and change data and summaries of your logs. It doesn't store the content of emails or documents.
- Where does it live, and who can see it?
- In your portal's region, agreed when you sign. You can see it in your portal, and so can the analysts on your account. It isn't shared with other customers.
- What happens when Verdict gets it wrong?
- Every quiet close is logged, and an analyst reviews a sample each week. Misses move the thresholds, and you see Verdict's accuracy in your monthly report.
- How long does it take to learn my business?
- Groundwork gives it a head start. The first 30 days after go-live are the learning period, so expect more "ask and review" in month one and fewer after that.
Known Normal starts with Groundwork.
Five business days to map your business, your crown jewels and who's who. That map becomes the first version of your Known Normal.