001Solved
“My rule fires 50 false positives a day.”
False-positive triage
- Multi-source DaC authoring
- Peer-baseline MAD-z
- Evidence chain on every alert
- 10-50× FP reduction
atrosa-detections · cross_source_temporal_correlation
Combine signals across the data sources you already have. 10-50x fewer false positives. Audit-defensible by design. Filing-grade end to end.
atrosa-detections · production hunt #114
Last 24h · 11:08 UTC
3 detections activecross_source_temporal_correlation
Fired on 4 users. Evidence chain attached.
Velocity × KYC × Device
peer_baseline_amount_anomaly
12 alerts. 11 confirmed in replay. 1 pending review.
Peer-group MAD-z
mule_account_velocity
Authored 12:42 UTC. Shadow Run on 90d backtest.
Graph + temporal
Alerts after de-noising · this week
142 alerts
5,420 events scanned · 37× fewer FPs
Detections audited end-to-end
See it work
Iteration
0
False Positives
-
SNR Score
0%
Pick your fraud pain
“My rule fires 50 false positives a day.”
atrosa-detections · cross_source_temporal_correlation
“My vendor locked me out at renewal.”
MIT-licensed substrate · `atrosa-cli` v0.2
“Backtest produces results, not audit-grade evidence.”
Confirmed wedge · Sift + Unit21 demos 2026-05-27
“My analysts hand-assemble cases for hours.”
Data connectors · case-mgmt stack-mate
“SAR write-ups take 2 hours each.”
M7 filing-package generator · 6-10 wks to v0
The roadmap is iterative. Tell us where analyst hours are bleeding and we'll author a detection family for it.
How ATROSA works
Stripe, Datadog, KYC providers, warehouse. ATROSA reads from where your data already lives. No event ingestion API, no SDK.
An iterative loop hunts patterns across sources, composes detections as Python, tests them against your history before they go live.
Every alert lands with its receipts. Which sources fired, which thresholds, which peer baselines. Analysts review a package, not a score.
Five-Ws narrative, typology citation, FFIEC defect-checker pass, BSA E-Filing XML. MLRO reviews and submits. AI does the assembly.
How ATROSA is different
Sift, Unit21, Hummingbird ship AI-assist on top of legacy workflow. ATROSA owns the loop: writes detection, runs investigation, emits the filing package.
vs. Sift / Sardine
AI suggests rules in a no-code UI. You approve. Artifact lives in their database as DSL.
AI authors DaC on your data. Artifact is Python in your repo. Audit reads like git blame.
vs. Unit21
AI rule recommendations from labeled history. Templates someone else's fraud team validated.
Cold-start without labels. DaC written for YOUR data on day one. 24h Shadow Run.
vs. Hummingbird / Lundy
Polishes the SAR UI. The investigation work itself doesn't get faster.
Filing-grade package end-to-end. Evidence cited from source. Defect-checker pass before MLRO review.
ATROSA owns the loop. Writes the detection, runs the investigation, drafts the filing. Your team reviews and approves what matters.
Writes detections from your data
Hunts patterns across sources. Composes Python detections combining velocity, peer-baselines, and cross-source signals.
Tests before it ships
Every authored detection runs against your history first. FP rates, recall, evidence-chain coverage. All measured before deploy.
Builds the case file itself
Pulls account history, transaction patterns, prior cases. Your analyst opens a package, not a score.
Drafts the filing, defect-checked
Five-Ws narrative, typology citation, FFIEC defect pass. MLRO reviews and submits. Assembly is autonomous. Accountability stays human.
# cross-source velocity detection
def detect_mule_velocity(df):
z = mad_z_score(
df, "outbound_amount",
peer_key="cohort",
)
velocity = peer_group_baseline(
df, "txn_per_hour",
)
signal = (z > 3.5) & (
velocity.ratio > 2.4
)
return build_evidence_chain(
df[signal], "mule_velocity_v3",
)Pricing
Open Source
Run the detection library on your own infra. Engineer-led adoption.
Star on GitHubSelf-serve
Seed-to-Series-A fintechs. AI-authored detections on YOUR data, hosted.
Request accessDetection Platform
Series A+ fintechs with engineering-led fraud teams.
Talk to founderPricing is hybrid base + usage. Enterprise tier ($500K-$5M) available for multi-region / multi-team. SOC 2 + DPA on the roadmap.
Questions fraud teams ask
DaC, Shadow Run, regulator trust. The questions fraud teams open with.
Detection logic lives as version-controlled Python in a repo, not as DSL in a vendor database. Same pattern Panther brought to SecOps. Your team reads the rule that fired, replays it on history, audits it like any code change. ATROSA's iterative loop authors that code from your raw data.
Those vendors ship AI that suggests rules in a no-code UI; the artifact lives in their database. ATROSA writes the DaC itself; the artifact is Python in your repo. They are pre-Cursor copilots, AI bolted onto a rule builder. ATROSA is the driver. The AI is the authoring layer.
We connect to your data sources read-only, replay 90 days of history through ATROSA's iterative loop, and produce a side-by-side. Which of your existing alerts ATROSA would have caught. Which it dismisses as false positives. What new patterns it surfaces. You see the FP-reduction number on YOUR data before you sign anything. 24h to first detection.
The rule is code, not a black-box score. Every parameter, threshold, source, and peer-baseline is inspectable. The replay simulator produces the same audit artifact in Shadow Run and production. Code review becomes the audit trail. For filing: the MLRO reviews and submits. Assembly is autonomous, accountability stays human, per FinCEN's October 2025 guidance.
Pull-only via data connectors. Stripe and Datadog are standard. KYC providers (Persona, Sumsub, Onfido), Snowflake / BigQuery / Postgres warehouses, Mixpanel / Segment behavioral. No event ingestion API, no SDK. We read from where your data already lives.
Every rule ships with replay receipts. We already know its historical false-positive rate before it deploys. If it misfires in production, you roll back like any code change. The evidence chain on each alert shows exactly which condition triggered. You edit the rule directly or hand it back to the loop with the new disposition labels.
Shadow Run produces a first detection within 24h of connecting your data sources. Full production deployment, including SOC 2 / DPA review and human approval gates, typically lands inside 2-4 weeks for self-serve. Longer for enterprise, depending on procurement.
SOC 2 Type II and DPA are on the roadmap. For Shadow Run, a PII sanitizer runs at the connector layer. Detections operate on anonymized signals while you evaluate. In production, post-DPA, full PII is available for case-file assembly. Audit logs cover both modes.
Shadow Run in 24h
Pull from your data sources. Run ATROSA's iterative loop on a 90-day backtest. Walk away with the FP-reduction number and the evidence chain. Even if you never become a customer.
Early access
ATROSA's autonomous detection platform is in private beta. Design partners get hands-on Shadow Run pilots. 24h to first detection on six months of your data, with regulator-grade audit.