FoundationDx uses adaptive AI to identify authentication anomalies, behavioral risks, and operational inefficiencies — before they become incidents. Designed for speed, accuracy, and affordability.
Healthcare organizations generate massive volumes of data across systems like DUO, Microsoft 365, EMRs, and network infrastructure.
FoundationDx solutions are currently deployed in healthcare environments analyzing large-scale datasets, uncovering anomalies that would be difficult and time-consuming to detect manually.
Findings surfaced in a single day's Action Plan:
| # | Priority | Finding | Where | Action | Comment |
|---|---|---|---|---|---|
| 1 | High | 🚫 BLOCKED NETWORK — account(s) with a successful sign-in from a tenant-blocked ASN | User Priority Queuetop of the queueanalyst report ↗ | Confirm with the user; if unexplained, reset credentials and revoke sessions. Check how the sign-in got past the block (which control, which path). | Counted within the critical accounts. The source address, application and time are in the account's finding. |
| 2 | High | CRITICAL — account(s) with a high-confidence attack combination | User Priority Queuetop of the queueanalyst report ↗ | Confirm the adversarial combination per account and contain as needed. | Highest-deviation first. Then check the campaign / org-wide panels for a shared root cause. |
| 3 | High | 💦 SPRAY SUCCEEDED — account(s): failures during a tenant-wide spray followed by an attacker-shaped success | User Priority Queue💦 spray hit taganalyst report ↗ | Reset credentials, revoke sessions and tokens, review registered MFA methods and mailbox rules, check what the session accessed after the success. | Held in today's list regardless of capacity — work right after fused and critical. |
| 4 | High | 🔐 CREDENTIAL ATTACK → SUCCESS — account(s) | Credential-Attack Failure Burstscritical rowsanalyst report ↗ | Confirm with the user; if unexplained reset the password, revoke sessions and tokens, review MFA methods and inbox rules. | Not deduplicated against spray-succeeded — an account can appear in both. |
| 5 | Medium | MAILBOX SENDING — account(s) with unusual outbound mail, no sign-in evidence | User Priority Queuetagged 📤 mailbox sendinganalyst report ↗ | Scan for silent external Bcc and high fan-out first; review sent items only where the sending is out of character for the person. | A review list, not incidents, and not counted in Priority Users. Tagged 📤 in the queue. A critical sign-in pair on any of these promotes it to FUSED RISK. |
| 6 | Medium | PHISH TARGETED — account(s) targeted, no takeover evidence | Campaign Pairssending infrastructure & subject themesanalyst report ↗ | Work as ONE campaign: identify the sending infrastructure and subject themes in the Campaign panel, block/quarantine at the mail gateway, brief the affected users. | Exposure, not compromise — not cases and not counted in Priority Users. Open an individual investigation only if an account later shows sending evidence. |
| 7 | Medium | 🔐 CREDENTIAL ATTACK HELD — account(s), password guessed or known, MFA / lockout stopped it | Credential-Attack Failure Burstshigh rowsanalyst report ↗ | For MFA-denied rows reset the password (it is known); for spray rows block the source IPs. Confirm the user did not trigger it. | Exposure, not compromise. A later success from an unfamiliar network escalates the row to CRITICAL on the next run. |
| 8 | Medium | 💦 SPRAY TARGETED — account(s) with failed authentications and no success evidence | Organization-Wide Signalssource IPs / ASNs, then Campaign Pairsanalyst report ↗ | Work as ONE campaign from the Org-Wide / Campaign panels: block the source IPs/ASNs at the identity provider or firewall, confirm smart-lockout and MFA held, re-run after containment. | Exposure, not compromise — not cases and not counted in Priority Users. Tagged 💦 sprayed in the queue. A later success escalates the account automatically. |
| 9 | Medium | Population / temporal — population-velocity (shared-infrastructure spray / credential-stuffing) signal(s), plus temporal first-seen / slow-drip / rising-trend signals — a volume that is not individually reviewable and mostly reflects ordinary churn; scan only the top rising trends | Population & Slow-Drip Anomaliesanalyst report ↗ | Review alongside the headline finding; check whether they share a root cause. | Secondary to the headline finding. |
| 10 | Low | Today's list — account(s) (SOC capacity 50): the fused, critical and spray-succeeded accounts above, then the highest-scoring | User Priority Queuetoday's list above the divideranalyst report ↗ | Work the list to completion. | The phish-targeted account(s) are outside this count (campaign line above). |
FoundationDx runs multiple independent detectors side by side — machine learning, adaptive rules, and per-user behavioral baselines — and correlates what they find. Each detector watches for a different kind of change, so threats that slip past one are caught by another, and the platform keeps learning your environment over time.
Deep analysis of DUO & Microsoft 365 authentication events to surface credential-based threats instantly.
User-level behavioral baselines detect deviations from normal patterns before they escalate.
Identify early warning signals of potential compromise or misuse across your entire environment.
Surface clinical and operational inefficiencies hidden in high-volume data streams.
Group complex numeric and categorical data into meaningful risk clusters — revealing hidden population-level patterns invisible to rule-based tools.
Some attacks break a user's pattern overnight. Others change it so gradually that no single day looks wrong. A tool built around one detector tends to catch only one of these. FoundationDx watches for both, on every account.
Compares each account against its own recent history and flags sharp breaks within the reporting window.
Each step is small enough to stay under a normal alert threshold, and a short-term baseline quietly moves along with it. Comparing against the long-term baseline exposes the cumulative change.
Each detector on its own is a partial view. When a slow drift on an account lines up with a sudden sign-in anomaly or an authentication finding, FoundationDx raises that account's priority. A single weak signal stays a low-priority review item. Your team sees fewer false alarms, and the quiet, long-running compromises that single-detector tools miss get surfaced.
FoundationDx analyzes Microsoft 365 sign-in and mailbox activity through a set of purpose-built detectors. Each one targets a different way accounts are attacked or misused, and each account is measured against its own history and against the rest of your organization.
Attempts to guess, stuff, or spray passwords, whether fast or deliberately slow.
Where a sign-in comes from, and what kind of network is behind it.
Changes in how a user works, whether sudden or building up gradually.
Patterns that only appear when you look across every account at once.
Mailbox behavior analyzed from message metadata. Message content is never read.
We are not a broad AI platform. We are purpose-built to uncover anomalies in complex healthcare data environments.
Purpose-built to uncover anomalies in complex healthcare data environments — not a broad AI platform trying to do everything.
Our models use a rolling behavioral baseline (e.g., 60-day learning window) to continuously adjust as user activity evolves.
We combine AI-driven insights with configurable rules, ensuring both flexibility and precision across your unique environment.
We prioritize meaningful alerts — not overwhelming volumes of data that exhaust your security team.
Available as a managed service or on-premise solution, with minimal overhead and rapid time to value.
Designed for organizations with high data volume but limited internal AI resources — we do the heavy lifting.
FoundationDx is a specialist layer that makes existing security investments smarter and more effective in healthcare — not a competitor, but a force multiplier.
FoundationDx is ideal for healthcare organizations that generate high volumes of authentication and operational data and need smarter, faster insight.
We make it easy to get started. No heavy lift. No unnecessary complexity.
Provide a scoped dataset from your environment — we handle the rest.
Our platform surfaces real risks and anomalies hidden in your data.
Receive actionable recommendations you can act on immediately.
No heavy lift. No unnecessary complexity.
Duo and Cisco Duo are trademarks or registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries. Microsoft 365 is a trademark or registered trademark of Microsoft Corporation in the United States and/or other countries. FoundationDx is not affiliated with, endorsed by, or sponsored by Cisco Systems, Inc. or Microsoft Corporation. All other trademarks, product names, and company names mentioned herein are the property of their respective owners.