Real-time anomaly detection scores every event as it arrives, from a sensor, payment, log line or camera, and raises an alert or triggers an action within milliseconds to seconds. The 2026 architecture is: ingest into a stream, score with a lightweight model at the edge or in the stream processor, enrich and route alerts, and close the loop with an automated or human action. Latency budget and false-alarm rate decide the design.
Updated October 2026
Who this is for: CTOs, IoT and OT leaders, SOC and fraud operations heads in manufacturing, energy, telecom, logistics and banking who need to act on problems in seconds, not in tomorrow's report.
The business problem: finding out too late
A batch job that finds yesterday's anomaly is a post-mortem, not protection. A compressor that started vibrating at 2 a.m. has already failed by the 8 a.m. report. A card-testing attack has already cleared hundreds of transactions. A misconfigured deployment has already burned through a day of cloud spend. The value of detection falls with every minute of delay, which is why the architecture matters as much as the model.
This post is about the streaming and real-time architecture. For the deep learning methods themselves (autoencoders, forecasting, graph models), read deep learning anomaly detection. For cameras and images, see visual anomaly detection.
What changed in 2026
- Azure AI Anomaly Detector is retired as of 1 October 2026; Microsoft points users to Microsoft Fabric or the open-source anomaly-detector project (Microsoft Learn). Streaming pipelines that called it need a new scoring step.
- Stream-native detection matured. Fabric Real-Time Intelligence anomaly detection (preview) runs in place on Eventhouse tables and can send anomaly events to Activator for automated responses (Microsoft Learn).
- SQL-level functions remain. Azure Stream Analytics still documents built-in spike-and-dip and change-point functions over sliding windows (Microsoft Learn), with no support for seasonality or multivariate correlation.
- Edge scoring became the default for OT. Our view: plants and sites increasingly score on the gateway and send only anomalies upstream, for latency, bandwidth and data sovereignty.
Reference architecture
Real-time anomaly detection: edge to action
Sensors, PLCs, logs, payments
Light model, ms latency
Event bus, windows, joins
Multivariate, cross-site
Labels, retraining
Stop line, block, ticket, agent
Dedupe, enrich, severity
Figure: Events from sensors, PLCs, logs or payments are scored first at the edge for millisecond decisions, then streamed for windowed and cross-site scoring. Alerts are deduplicated, enriched and routed to an automated or human action, and outcomes feed back as labels for retraining.
Latency budgets drive placement
| Decision needed in | Where to score | Typical use |
|---|---|---|
| Milliseconds | On device or gateway | Machine safety, line stop, robot control |
| Sub-second to seconds | Stream processor near the source | Payment fraud, network faults, log anomalies |
| Minutes | Real-time analytics store | KPI monitoring, energy use, quality trends |
| Hours | Managed batch service | Cloud cost spikes, e.g. AWS Cost Anomaly Detection, which starts detecting within 24 hours of setup |
Design rules that hold up in production
- Learn online, adapt to change. The Numenta Anomaly Benchmark paper lists the core requirements: process data as it arrives, detect as early as possible, avoid false alarms and adapt automatically when statistics change.
- Size windows to the data rate. Stream Analytics ties window duration to history size and events per second, and its scoring cost grows linearly with history. Bigger is not always better.
- Two tiers of scoring. Simple univariate checks at the edge; heavier multivariate or deep models centrally or on edge GPUs.
- Deduplicate and enrich before alerting. One incident should create one alert with context, not 300 pages.
- Close the loop. Operator feedback is your label set for the next model.
Related reading: edge analytics, real-time AI inference and agentic log analytics.
Need detection in seconds, not tomorrow? Book a real-time architecture review and get a latency budget and placement plan for your streams.
How to start in 30 days
- Week 1: Choose one stream and one costly failure mode. Set a latency budget and an acceptable false-alarm rate.
- Week 2: Deploy a baseline detector in the stream; log scores without alerting.
- Week 3: Add a learned model at the edge or in the stream; compare detection time and false alarms.
- Week 4: Turn on alert routing for one team, with a feedback button. Measure time-to-detect.
Where it's heading: 2020 → 2030
| Year | State |
|---|---|
| 2020 | Cloud APIs and threshold rules on streams (history). |
| 2026 | Stream-native detection, edge scoring, Azure API retired. |
| 2028 | Expected: multivariate deep models on edge GPUs by default in OT. |
| 2030 | Our view: agents triage and remediate most alerts within policy. |
How NexaStack helps
NexaStack runs intelligence where decisions happen. Its Edge AI capabilities process data at the source without needing cloud connectivity, push and update detection models across many edge nodes from a central orchestrator, and support on-device agents and air-gapped sites. The Observability and Evaluation Layer then tracks how detectors and responses perform.
FAQ
What is real-time anomaly detection?
Scoring each event as it arrives and acting within a defined latency budget, usually milliseconds to seconds.
Should anomaly detection run at the edge or in the cloud?
At the edge when you need millisecond decisions, limited bandwidth or data sovereignty; centrally for cross-site, multivariate patterns. Most teams use both.
How do we avoid alert fatigue?
Tune thresholds against a target false-alarm rate, deduplicate related alerts and use operator feedback to retrain.
Is it hard to integrate with our existing OT and SIEM tools?
No. Detectors read from existing streams and send alerts to the tools you already use; nothing needs to be replaced on day one.
What are the latest real-time anomaly detection trends in 2026?
Stream-native detection, edge scoring, retirement of single-purpose APIs and agent-assisted triage.
Cut time-to-detect from hours to seconds. Request a real-time anomaly detection pilot on one stream.
