FoundationDx uses adaptive AI to identify authentication anomalies, behavioral risks, and operational inefficiencies — before they become incidents. Designed for speed, accuracy, and affordability.
Healthcare organizations generate massive volumes of data across systems like DUO, Microsoft 365, EMRs, and network infrastructure.
FoundationDx solutions are currently deployed in healthcare environments analyzing large-scale datasets, uncovering anomalies that would be difficult and time-consuming to detect manually.
Findings surfaced in a single day's Action Plan:
| # | Priority | Finding | Where | Action | Comment |
|---|---|---|---|---|---|
| 1 | High | 🚫 BLOCKED NETWORK — account(s) with a successful sign-in from a tenant-blocked ASN | User Priority Queuetop of the queueanalyst report ↗ | Confirm with the user; if unexplained, reset credentials and revoke sessions. Check how the sign-in got past the block (which control, which path). | Counted within the critical accounts. The source address, application and time are in the account's finding. |
| 2 | High | CRITICAL — account(s) with a high-confidence attack combination | User Priority Queuetop of the queueanalyst report ↗ | Confirm the adversarial combination per account and contain as needed. | Highest-deviation first. Then check the campaign / org-wide panels for a shared root cause. |
| 3 | High | 💦 SPRAY SUCCEEDED — account(s): failures during a tenant-wide spray followed by an attacker-shaped success | User Priority Queue💦 spray hit taganalyst report ↗ | Reset credentials, revoke sessions and tokens, review registered MFA methods and mailbox rules, check what the session accessed after the success. | Held in today's list regardless of capacity — work right after fused and critical. |
| 4 | High | 🔐 CREDENTIAL ATTACK → SUCCESS — account(s) | Credential-Attack Failure Burstscritical rowsanalyst report ↗ | Confirm with the user; if unexplained reset the password, revoke sessions and tokens, review MFA methods and inbox rules. | Not deduplicated against spray-succeeded — an account can appear in both. |
| 5 | Medium | MAILBOX SENDING — account(s) with unusual outbound mail, no sign-in evidence | User Priority Queuetagged 📤 mailbox sendinganalyst report ↗ | Scan for silent external Bcc and high fan-out first; review sent items only where the sending is out of character for the person. | A review list, not incidents, and not counted in Priority Users. Tagged 📤 in the queue. A critical sign-in pair on any of these promotes it to FUSED RISK. |
| 6 | Medium | PHISH TARGETED — account(s) targeted, no takeover evidence | Campaign Pairssending infrastructure & subject themesanalyst report ↗ | Work as ONE campaign: identify the sending infrastructure and subject themes in the Campaign panel, block/quarantine at the mail gateway, brief the affected users. | Exposure, not compromise — not cases and not counted in Priority Users. Open an individual investigation only if an account later shows sending evidence. |
| 7 | Medium | 🔐 CREDENTIAL ATTACK HELD — account(s), password guessed or known, MFA / lockout stopped it | Credential-Attack Failure Burstshigh rowsanalyst report ↗ | For MFA-denied rows reset the password (it is known); for spray rows block the source IPs. Confirm the user did not trigger it. | Exposure, not compromise. A later success from an unfamiliar network escalates the row to CRITICAL on the next run. |
| 8 | Medium | 💦 SPRAY TARGETED — account(s) with failed authentications and no success evidence | Organization-Wide Signalssource IPs / ASNs, then Campaign Pairsanalyst report ↗ | Work as ONE campaign from the Org-Wide / Campaign panels: block the source IPs/ASNs at the identity provider or firewall, confirm smart-lockout and MFA held, re-run after containment. | Exposure, not compromise — not cases and not counted in Priority Users. Tagged 💦 sprayed in the queue. A later success escalates the account automatically. |
| 9 | Medium | Population / temporal — population-velocity (shared-infrastructure spray / credential-stuffing) signal(s), plus temporal first-seen / slow-drip / rising-trend signals — a volume that is not individually reviewable and mostly reflects ordinary churn; scan only the top rising trends | Population & Slow-Drip Anomaliesanalyst report ↗ | Review alongside the headline finding; check whether they share a root cause. | Secondary to the headline finding. |
| 10 | Low | Today's list — account(s) (SOC capacity 50): the fused, critical and spray-succeeded accounts above, then the highest-scoring | User Priority Queuetoday's list above the divideranalyst report ↗ | Work the list to completion. | The phish-targeted account(s) are outside this count (campaign line above). |
FoundationDx combines machine learning with adaptive rules to identify patterns that traditional tools miss. Our platform continuously learns your environment — so detection improves over time.
Deep analysis of DUO & Microsoft 365 authentication events to surface credential-based threats instantly.
User-level behavioral baselines detect deviations from normal patterns before they escalate.
Identify early warning signals of potential compromise or misuse across your entire environment.
Surface clinical and operational inefficiencies hidden in high-volume data streams.
Group complex numeric and categorical data into meaningful risk clusters — revealing hidden population-level patterns invisible to rule-based tools.
Using real-world data, FoundationDx identifies threats and anomalies that are often early indicators of security threats or system misuse.
We are not a broad AI platform. We are purpose-built to uncover anomalies in complex healthcare data environments.
Purpose-built to uncover anomalies in complex healthcare data environments — not a broad AI platform trying to do everything.
Our models use a rolling behavioral baseline (e.g., 60-day learning window) to continuously adjust as user activity evolves.
We combine AI-driven insights with configurable rules, ensuring both flexibility and precision across your unique environment.
We prioritize meaningful alerts — not overwhelming volumes of data that exhaust your security team.
Available as a managed service or on-premise solution, with minimal overhead and rapid time to value.
Designed for organizations with high data volume but limited internal AI resources — we do the heavy lifting.
FoundationDx is a specialist layer that makes existing security investments smarter and more effective in healthcare — not a competitor, but a force multiplier.
FoundationDx is ideal for healthcare organizations that generate high volumes of authentication and operational data and need smarter, faster insight.
We make it easy to get started. No heavy lift. No unnecessary complexity.
Provide a scoped dataset from your environment — we handle the rest.
Our platform surfaces real risks and anomalies hidden in your data.
Receive actionable recommendations you can act on immediately.
No heavy lift. No unnecessary complexity.
Duo and Cisco Duo are trademarks or registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries. Microsoft 365 is a trademark or registered trademark of Microsoft Corporation in the United States and/or other countries. FoundationDx is not affiliated with, endorsed by, or sponsored by Cisco Systems, Inc. or Microsoft Corporation. All other trademarks, product names, and company names mentioned herein are the property of their respective owners.