Unusual access caught the same day,
a human decides what it means
Most security incidents leave a trail in the logs well before anyone notices, a login from an unexpected country, a sudden run of failed attempts, an account suddenly reaching for permissions it never used before. A security monitoring agent watches that trail continuously and alerts the moment a pattern looks unusual, with a drafted incident note ready. It never revokes access or locks an account itself, that decision stays with a human.
The role today
Most security incidents are visible in the logs before they become a real problem, an account logging in from an unfamiliar country, a sudden burst of failed login attempts, a service account reaching for a permission it has never used before. The signal is there; the problem is that nobody is watching it closely enough, continuously, to catch it before it becomes an incident report instead of a quiet correction.
The second cost is that manual log review, when it happens at all, happens after something has already gone wrong, as part of the investigation rather than as the thing that would have prevented it.
The third is that a genuinely useful security alert needs enough context to be actionable immediately, not just “something happened,” and building that context by hand, after the fact, during an active concern, wastes exactly the time that matters most.
What the agent takes over
The agent watches your auth logs, access patterns, and permission changes continuously, checking them against a set of known risk patterns: unusual login locations, repeated failed attempts, privilege escalation, access outside normal hours for a given account. When something matches, it drafts an incident note immediately, the relevant log excerpts, the specific pattern that triggered the alert, a timeline, and sends it to whoever owns security on your team.
A tuning window before full deployment matters here more than almost anywhere else: a security tool with too many false alarms gets muted, which defeats the purpose, so thresholds get calibrated against your actual access history before it is trusted at full volume.
Typical scope: auth logs, access pattern anomalies, permission changes. It is a detector, not an enforcer, every action beyond alerting is a separate, more carefully scoped capability.
What stays with humans
Deciding whether a detected anomaly is actually malicious, and what to do about it, locking an account, requiring a password reset, escalating further, stays entirely with your team. Anything involving legal or law-enforcement steps is obviously outside the agent’s role.
Guards
The agent is read-only against your logs; it never locks an account, revokes access, or takes punitive action on its own under any configuration. Every detection is logged with the exact pattern that triggered it, so a human reviewing an alert can see precisely why it fired. A deliberate tuning window runs before full deployment to bring the false-positive rate down first.
Price and timeline
| Option | Price | What it covers | Timeline |
|---|---|---|---|
| Agency runs it | from $2,800 + support plan | Agent built, tuned and supervised by us, monthly detection review | 2 to 4 weeks |
| Full control, handover-ready | from $4,800 | Same agent on your own logs and systems, documented risk rules, your team runs it | 4 to 6 weeks |
Running cost is usually $20 to $70 a month in model usage, depending on log volume.
Related
See the AI agents service page and automation-everything for the surrounding build. Within this group: access and permissions agent, incident responder agent, and AI policy and guardrails agent cover adjacent ground. For related one-time setups, see automate API rate limit abuse monitoring and automate access reviews and offboarding. Real governance discipline behind this page: the ProBay AI agent team case study, where every one of eight agents runs inside a logged, approval-gated structure.
Not sure who still has access to what? Get in touch and we will look at your current logs first.
FAQ
How much does a security monitoring agent cost?
From $2,800 to wire into one system's auth logs and access patterns, live in 2 to 4 weeks. Multiple systems or a more detailed risk model usually runs $4,500 to $7,000.
How long before it is catching real anomalies?
2 to 4 weeks: the first weeks build and tune its sense of normal against your actual access history, since a security agent with too many false positives gets ignored just as fast as one with too few true ones.
Which systems does it watch?
Your auth provider's logs, application access logs, and admin panel activity, wherever logins and permission changes are recorded. It reads logs; it does not require deep access to the systems themselves.
What happens when it detects something unusual?
It alerts the person who owns security on your team with a drafted incident note already attached, log excerpts, the pattern that triggered it, a timeline. Deciding whether it is actually malicious and what to do about it stays a human call.
Can it lock accounts or revoke access on its own?
No, not by default, and we recommend against it for most teams. This agent detects and alerts; the access and permissions agent, if you also want automated revocation recommendations, still routes every action through a human approval.