Earlier this month, we launched Attack Detection Agent, the first part of the Fraud Attack Defense Suite, to help fraud teams catch attacks sooner. Today, we’re taking that focus on speed a step further.
Fraud now runs at AI speed, with attackers automating campaigns at massive scale. One recent campaign chained three open-source AI agents to breach at least 27 online retailers, with under $18,000 spent on model access. Yet much of fraud prevention still relies on manual work. Analysts piece together user histories across screens, review cases one by one, tune workflows by hand, and hunt through documentation for answers. Even the best analysts can’t outpace automated attacks with manual processes.
As AI models become commodities for fraudsters and fraud fighters alike, the real advantage lies in what’s built around them: the workflows, decisioning, and governance that turn intelligence into action while keeping teams in control. That’s where we’re investing.
We’re introducing a broader set of AI offerings that accelerate fraud detection and decisioning. Each one targets a different part of the analyst’s day, from finding the right information faster to making decisions with more context, so teams spend less time on repetitive work and more on the decisions that matter.
Risk Activity Agent: Spot risky sessions in seconds
Risk Activity Agent (formerly ATO Activity IQ) reads a user’s behavioral history across sessions, shows what normal looked like for that user, and flags the sessions that look risky. Instead of reconstructing a session by hand across multiple screens, your analyst gets a clear summary of what happened. A review that could take 5 to 30 minutes becomes a summary in seconds, so your team starts with the pattern instead of hunting for it. The call stays with your analyst. It’s available now to Account Defense customers.
MCP Server: Investigate users from your own AI agent
The Sift MCP Server is an agentic gateway into Sift. It lets your own AI agent query Sift directly, so an analyst can ask about a user and get back the score, top risk signals, attributes, labels, and decisions without opening the Console. Instead of switching tools, your team investigates inside the ones they already use, and off-the-shelf agent tools connect with no custom integration to build or maintain. It’s read-only by design: an agent can see what your team can see, but it can’t create or change a decision, label, or Workflow. A bulk users tool is coming next, taking your agent from looking up a single user to looking at a whole population.
Review Agent: Get key signals and a suggested decision on every case
Review Agent reads a case and hands your analyst the signals that matter: color-coded risk and trust signals, a short plain-language explanation, and a suggested action of Block, Accept, or Watch. Instead of digging through a case to work out where to look first, your analyst starts with the evidence already organized. It appears in User Details, generates automatically in Review Queues, and can be generated on demand in Explore. The suggestion is a starting point, and your analyst makes the final call. On average, customers report spending 15 to 20% less time on manual review.
Coming next: Optimize Workflows and get answers inside the Console
Workflow Optimization Agent looks at your Workflows against past activity and traffic, then recommends optimization changes based on what it finds and on best practices from Sift’s global network. Instead of tuning by hand and waiting to see how a change performs, your team starts with specific recommendations to review. And because it runs on data no single merchant has, it reasons over Sift’s cross-merchant network, not just your own traffic. That gives your team context it couldn’t build on its own. Your analysts review each recommendation and decide what to apply.
Sift Copilot answers questions about your data, the Console, your Workflows, and our documentation without your analyst leaving the page. Instead of switching between screens and searching documentation for an answer that exists somewhere, your team can ask in the moment and keep working. It works across all Workflows and all products, so the same assistant is available wherever your analysts are in the Console.
You choose the mode: Assistant or automation, scenario by scenario
Every offering starts in assistant mode, where AI provides insights and recommendations while your analysts make the final call. Review Agent, for example, surfaces a suggested decision for your team to evaluate. Over time, you can move toward automation, choosing which scenarios to automate and when, with the flexibility to adjust as your needs change.
The goal goes beyond speed. By reducing manual work and helping teams make more confident decisions, these capabilities can help catch fraud earlier, approve more trusted customers, and minimize unnecessary friction, all while keeping your team in control.
If you’re evaluating Sift, talk to our team. And if you missed it, here’s how the Attack Detection Agent helps you catch attacks earlier.
