They've already got anomaly detection: their users.