Every user against their own baseline, every day
Multiple testingHardProblem. Your detector scores each of 80,000 employees against their own behavioral baseline, every day, and alerts at three standard deviations. A colleague says three sigma means 0.3% false positives, so expect about 240 alerts a day, which is a lot but manageable. Is that right?
Before you reveal: say your answer out loud, as if you were in the real interview — get your reasoning across clearly first. There is no single correct answer: reading what the interviewer is really after and defending your own thinking is what makes an answer strong.