Black Hat USA 2025 | FACADE: High-Precision Insider Threat Detection Using Contrastive Learning

Why It Matters

Facade demonstrates that high‑precision insider threat detection can be achieved without large labeled attack datasets, reshaping security strategies for enterprises. Its open‑source availability lowers barriers for widespread adoption, potentially reducing costly data breaches.

Key Takeaways

• Facade uses self‑supervised contrastive learning on benign logs
• Detects insider actions with false positives under 0.01%
• Scans billions of daily events across Alphabet for 7 years
• Open‑source release enables broader enterprise adoption
• Clustering enhances robustness for single‑action anomalies

Pulse Analysis

The emergence of Facade marks a pivotal shift in insider threat mitigation, moving away from reliance on scarce incident data toward self‑supervised models that learn normal behavior from massive benign logs. By employing contrastive learning, the system creates nuanced representations of user actions across document accesses, SQL queries, and network requests, enabling it to flag subtle deviations that traditional rule‑based tools miss. This methodological breakthrough not only improves detection precision but also dramatically reduces the operational overhead associated with labeling and maintaining attack datasets.

Beyond the core algorithm, Facade integrates a sophisticated clustering layer that groups similar anomalous events, enhancing robustness against noise and isolated false alarms. The result is an exceptionally low false‑positive rate—under 0.01% overall and 0.0003% for single‑action anomalies—making the solution viable for high‑volume environments where alert fatigue is a major concern. Over seven years, the system has processed billions of daily events within Alphabet, proving its scalability and reliability at enterprise scale.

The decision to open‑source Facade expands its impact beyond Google, offering security teams a ready‑made framework for building context‑aware insider threat detectors. Organizations can adapt the model to their own log sources, benefiting from the same contrastive learning principles without the need for extensive labeled attack data. As cyber‑risk executives prioritize proactive defenses, Facade provides a cost‑effective, high‑accuracy tool that aligns with modern zero‑trust and data‑centric security architectures, potentially setting a new industry standard for insider threat detection.

Original Description

While insider threats are a critical risk to organizations, little is publicly known about how to detect those attacks effectively. To help address this gap, we present FACADE: Fast and Accurate Contextual Anomaly DEtection, Google's internal AI system for detecting malicious insiders. FACADE has been used successfully to protect Alphabet by scanning billions of events daily over the last 7 years.

At its core, Facade is a novel self-supervised ML system that detects suspicious actions by considering the context surrounding each action. It uses a custom multi-action-type model trained on corporate logs of document accesses, SQL queries, and HTTP/RPC requests. Critically, FADADE leverages a novel contrastive learning strategy that relies solely on benign data to overcome the scarcity of incident data.

Beyond its core algorithm, Facade also leverages an innovative clustering approach to further improve detection robustness. This combination of innovative techniques led to unparalleled accuracy with a false positive rate lower than 0.01%. For single rogue actions, such as the illegitimate access to a sensitive document, the false positive rate is as low as 0.0003%.

Beyond presenting the underlying technology powering Facade during this talk, we will showcase how to use the just released Facade open-source version so you can use it to protect your own organizations.

By:

Alex Kantchelian | Staff Software Engineer, Google

Elie Bursztein | Security & Anti-Abuse Research Lead, Google

Birkett Huber | Senior Software Engineer, Google

Casper Neo | Senior Software Engineer, Google

Sadegh Momeni | Senior Software Engineer, Google

Yanis Pavlidis | Senior Software Engineering Manager, Google

Ryan Stevens | Senior Software Engineer, Google

Presentation Materials Available at:

https://blackhat.com/us-25/briefings/schedule/?#facade-high-precision-insider-threat-detection-using-contrastive-learning-46751