How is this different from Anomaly Detection?

Anomaly Detection watches spend — a spike relative to baseline. Compromise Risk watches behavior — a new source IP or a new model family for a specific key, which can fire even if the call volume and cost look completely normal for a while.

Why doesn't a brand-new key trigger a signal on its very first calls?

Every value would look 'new' for a key with no history yet, so the very first few calls would all look like compromise. A signal only fires once a key has an established pattern (a minimum number of prior calls under a different value in that dimension) for this call to genuinely depart from.

What counts as a 'new model family'?

Model names are bucketed into families — gpt, claude, gemini, mistral, llama, embedding, and separately openai-image and google-image for image-generation models. A chat-only key suddenly calling an image model is flagged as a new family, not just a new model.

Does a medium-severity signal do anything besides alert?

No — only a high-severity signal (currently: a key's first-ever image-generation call) is eligible for auto-freeze, and only if you've opted in. Medium-severity signals (a new source IP, most new model families) just alert.

Can I dismiss a signal that turns out to be a false positive?

Yes, from the Compromise Risk page. A deploy to a new region, or deliberately adding a second model to a key, will both look 'new' the first time — dismissing tells Cognocient nothing else, it's purely for your own list hygiene.

How does Cognocient detect a compromised proxy key?

Compromise Risk flags a proxy key suddenly called from a source IP or model family it's never used before — a signal independent of cost anomaly detection, which can miss a compromise that stays cost-normal.

Compromise Risk is a second, independent detector alongside Anomaly Detection — instead of watching for a spend spike, it watches for a proxy key suddenly being used in a way it never has before. A stolen key making cost-normal calls from a new location for a while wouldn't trip a spend anomaly at all; this is built to catch exactly that gap.

The two signals

Both signals are per-proxy-key, not per-account — each key builds its own independent history of source IPs and model families it has actually been used with.

Signal	What it means	Default severity
New source IP	This key has never been called from this IP before	Medium
New model family	This key has never been called with a model from this family before	Medium, or High if the new family is an image-generation model

Model names are bucketed into families for this check — gpt, claude, gemini, mistral, llama, embedding, and separately openai-image / google-image for image-generation models. A key that's only ever called chat models suddenly calling dall-e-3 or imagen-3 is flagged as a new family, not just a new model name — this is deliberately the same shape of signal that would have caught the image-generation billing spike this feature was built in response to, had it been running through a proxy.

Why new keys don't immediately trigger signals

A signal only fires once a key already has an established baseline in that dimension — a minimum number of prior calls recorded under some other value. Without that guard, every key's first few calls would all look "new" simply because there's no history yet to compare against, and every signup would generate a false alarm.

Severity and auto-freeze

Only a high-severity signal is eligible for automatic freeze, and only if you've turned on Auto-freeze on high-risk signals in Settings — off by default. A medium-severity signal (a new source IP, most new model families) alerts via Slack but never freezes on its own.

Reviewing and dismissing signals

Active signals appear on the Compromise Risk dashboard page, each showing the key involved, what changed, and when. Dismissing a signal is purely for your own list hygiene — it doesn't feed back into detection, so a deliberate change (a new region deploy, adding a second model to a key on purpose) is safe to dismiss without affecting future signals.

What this does not catch

Compromise Risk only sees traffic that reaches Cognocient's proxy with a valid key. A stolen provider API key called directly, bypassing the proxy entirely, produces no signal here — see Shadow Spend Reconciliation for the feature built specifically to catch that.