Monitoring Policies

Monitor all wire transfer overrides >$10K. Escalate when 3+ overrides occur within a 7-day window or during supervisor absence.

Flag access to production systems outside business hours (6PM-7AM) when not associated with approved maintenance tickets.

Detect transaction patterns that cluster within 5% of CTR reporting threshold ($10,000). Alert on 3+ sub-threshold transactions from same member within 48h.

Monitor for combinations of: resume update signals, increased PTO requests, Glassdoor review sentiment, and declining engagement scores.

Monitor all privileged service accounts for concurrent sessions, geographic anomalies, and access outside approved IP ranges.

Use Benford analysis on vendor payment first digits. Flag when distribution deviates >2 standard deviations from expected frequency.

NLP analysis of member complaints across channels. Escalate when negative sentiment increases >200% over rolling 7-day average.

Monitor loan approvals against officer authority limits. Flag any approval within 10% of limit or approvals for related members.

ML-based email communication pattern analysis. Flag deviations in writing style, sender behavior, and request types. Trigger MFA verification on urgent wire transfer requests from anomalous patterns.

Cross-reference incoming invoices and payment instructions against vendor baseline profiles. Flag any changes to banking details, invoice format deviations, or new payment routing.

Monitor crypto wallet transactions for patterns matching pig butchering, mixer usage, or sanctioned entity transfers. Real-time risk scoring via Chainalysis integration.

Continuous risk scoring of crypto wallet addresses. Flag wallets associated with known fraud rings, mixer services, or OFAC-sanctioned entities. Block transactions scoring above 85.

Continuous attack surface monitoring mapped to ransomware group TTPs (MITRE ATT&CK). Score based on exposed services, unpatched CVEs, dark web intelligence, and credential leak exposure.

Detect AI-generated phishing emails using linguistic analysis, metadata anomalies, and known AI-crafted template fingerprints. Correlate with OSINT feeds on emerging AI attack tools.

Continuous monitoring of third-party vendor security posture. Score and alert on changes in vendor risk profiles, breach disclosures, CVE exposure, and compliance certification lapses.