Threat detection system with machine models for accounts within an organization unit

Abstract

A processing device receives a request to create a second account in a cloud computing system having multiple web services. The request specifies an organization unit (OU) associated with a first account of the cloud computing system. A first instance of a threat detection service monitors activity data associated with the first account and detects anomalous activity by the first account using a first machine learning (ML) model. The processing device creates the second account and attaches the second account to the OU. The processing device generates a second ML model for the second account using at least a portion of the first ML model and monitors subsequent activity data associated with the second account using the second ML model to detect anomalous activity by the second account.