Closing the Detection-to-Response Gap
Attackers move fast—often faster than the security teams defending against them. The window between when a breach occurs and when it is detected is where the real damage happens: data gets exfiltrated, sessions get hijacked, and attackers gain a foothold. Traditional security models are reactive by design; they identify compromises after the fact, leaving defenders to focus on cleanup rather than prevention.
Slack's answer is Anomaly Event Response (AER), a proactive defence mechanism built directly into the platform. AER combines real-time monitoring with advanced analytics to autonomously identify high-confidence threat actor behaviours as they emerge, then terminates the associated user sessions. This compresses what could be days or hours of detection-to-response lag down to minutes, disrupting attack chains before they are fully executed—without requiring additional security tools, integrations, or headcount.
Detection Priorities
AER was designed around threat behaviours that are common across platforms. The detection engine focuses on:
- Accessing Slack from a Tor exit node
- Excessive downloading as a potential indicator of data exfiltration
- Data scraping via non-Slack-native automation tools
- Session fingerprint mismatches
- Unexpected API call volumes and patterns
- Unexpected user agents indicating access from non-standard or virtual clients
Because every organization uses Slack differently, AER gives Enterprise Grid customers control over which detections are active. For each anomaly type, customers can choose whether AER should terminate sessions or simply log the event without taking action. Notification preferences are configurable in the same way.
Configuration is handled through Tools and Settings → Organization settings → Security (left-hand sidebar) → Security Settings, where an Anomaly Event Response Settings section lets admins select which anomaly events trigger session termination and how notifications should be routed.
System Architecture
AER's architecture is composed of three core components: a detection engine, a decision framework, and a response orchestrator.
The detection engine monitors Slack events at a scale of billions per day. It relies on a mix of rule-based heuristics and dynamic thresholds calibrated to each enterprise's usage patterns. For example, what constitutes excessive downloading for one organization might be normal baseline behaviour for another. By calculating thresholds from historical organizational data, AER keeps false positives down while allowing fine-tuning of detection sensitivity across the customer base.
The decision framework evaluates each audit payload produced when suspicious behaviour is identified. It runs validation checks based on the customer's AER configuration and internal rules, analyzing the payload and its preceding events. This includes examining the session(s) associated with every audit payload to determine whether malicious behaviour is persisting through user session terminations, and to guard legitimate users from an endless termination loop.
Once an anomaly passes validation and the customer has enabled detection for that event type, an asynchronous job is enqueued to perform the autonomous response.
Automated Response and Notifications
The response orchestrator terminates all active sessions belonging to the acting user, then executes follow-up actions for transparency and accountability. AER generates a user_sessions_reset_by_anomaly_event_response audit log that captures the anomaly type that triggered the response, context about the acting user, and the session_id from which the anomaly event originated. This datapoint makes it possible to trace activity back to the originating anomaly audit log during an investigation.
After logging, AER queries the customer's notification preferences. The acting user always gets an email notification confirming their sessions were terminated. Additional notifications can be routed to up to two other contact types based on customer configuration: the Org Primary Owner and users with the Security Admin system role.
Smart notification logic prevents duplicate alerts when a person holds multiple roles. If the same individual is both Org Primary Owner and Security Admin, they receive one notification per event rather than multiple. These contacts can choose email, in-Slack DM notifications via the Slack Security bot, or both.
Impact So Far
AER became available in February 2025. Its autonomous interventions validate the case for proactive security: automatically terminating sessions that engage in anomalous activity prevents incidents that might otherwise go undetected. For enterprise customers, the benefit is twofold—better protection of data and lower security team overhead.
The context is stark. IBM's most recent Cost of a Data Breach Report pegged the average breach cost at $4.88M USD in 2024, with an average incident response time of 277 days for cloud-based collaboration platforms. AER's ability to shrink the detection-to-response window is a meaningful step toward disrupting attacker advantage while Slack remains a central hub for workplace communication across tens of millions of weekly users and billions of daily interactions.
AER is positioned as a baseline layer of defence for Enterprise Grid customers that might not have the resources to build integrations around Slack's existing audit logs. For customers with more mature security operations, it can complement existing tools without blocking tailored measures. Slack continues to support comprehensive audit log output for enterprise customers, including specialized anomaly logs that flag irregular logins, malware uploads, unexpected data transfers, and other unusual activity.
The shared responsibility model is embedded in Slack's approach to platform security—providing advanced, out-of-the-box protection while permitting customization for organizations with sophisticated security requirements. AER is the operative example of that philosophy, designed to work in the background with minimal intervention as the threat landscape evolves.
