Use casesAnomaly diagnosis

A number moved. Find out why before the moment to act has passed.

Every monitoring tool tells you a number moved. Finding out why costs a morning of slicing data, and a language model asked to guess will give you a fluent wrong answer. Verdict, our accelerator, finds the likely cause with math inside Snowflake, uses a model only to explain it, and says so when it finds none.

Start a project Arrange a call

What gets in the way

Revenue spikes on a Tuesday. A sensor channel drifts. The dashboard says what moved and nothing about why, and by the time someone has sliced the data by region, device and channel, the moment to act has passed.

Asking a language model looks like a shortcut. Published research shows language models do not reliably reason about time-series anomalies. A fluent wrong answer is worse than none.

So we built Verdict to diagnose with math and use a model only for the words. Every result we publish comes from public data and benchmarks, and the open problems are published beside them.

What we build

Six pluggable stages, from data adapter to evaluation. The answer is settled in code before any model is called.

A detector scores every day against the whole series. A separate check watches for a total that collapses toward zero, the signature of a tracking outage.
Decomposition compares each slice with its own two-week baseline: how much of the change it carries and how surprising its new share is. The cause is where the surprise is, not where the activity normally lives.
Two deterministic checks route each case before any model runs. Did the total collapse? Is the change spread so evenly that no slice stands out? If so, Verdict says it found no cause, and stops.
Snowflake Cortex gets a structured evidence package and an instruction to translate it, not to speculate. It writes one brief for each of five readers.
Onboarding a dataset means writing one adapter. On day one, a profiler reads unseen data and recommends a method with a false-alarm risk estimate.

How we know it works

Predictions are registered before each experiment. The ones that fail stay in the record unedited.

On a public industrial benchmark with 17 channels and 200 labeled anomalies, Verdict ranks the right channel first 86% of the time. A simple threshold detector gets 56%. Chance gets 14%.
Every figure carries a 95% confidence interval. Every comparison between methods is a paired statistical test. Every published number traces to one manifest of 97 recorded runs across 10,300 labeled anomaly windows.
On a simulated chemical plant with 52 channels, the true cause ranks first only 8.7% of the time. That is our central open problem, and the next experiment is registered against it.
For a client without labels, we inject known anomalies into its own data, so accuracy is measured before anyone is asked to trust it.

Our accelerator

Measured on public benchmarks

Every anomaly gets a verdict. Or an honest silence.

Verdict is EPOCH’s own accelerator, demonstrated on public data and benchmarks. Math finds an anomaly’s likely cause inside Snowflake, a model only explains it and Verdict says so when it finds none.

86% right cause ranked first on a public benchmark, against 14% by chance

8.7% right cause first on a simulated chemical plant, our open problem

10,300 labeled anomaly windows behind the measurements

Read the story

Verdict anomaly diagnosis

Where it fits

Questions

What happens when Verdict is not sure?

It says so. If the total collapsed, or the change is spread evenly across every slice, no model is called and the brief says the event looks system-wide. An honest silence is a result.

Does it leave our Snowflake account?

No. Detection, decomposition and routing run as SQL and Python inside the account, and narration runs through Snowflake Cortex there too. It ships as a Streamlit app in your account, with a web workbench over a typed API if you want one.

How do we know it works on our data?

Before anyone trusts it, we inject known anomalies into your own series and measure how often Verdict names the right slice. You see the score before you see a brief.

Why publish the failures?

Because the number you would be sold otherwise is the one from the easy test. We would rather you knew where it stops.

Bring us the project that matters most.

Tell us what you’re building and what’s in the way. You’ll hear back within 24 hours.

Start a project Arrange a call