A method for detecting compromised scopes in an online service, comprising: receiving detection results of behaviors occurring on devices within the online service; scoring the detection results based on how anomalous the respective behaviors are within the online service; organizing the scored detection results according to scopes; applying multi-signal detection logic to a given scope to produce a confidence score indicating whether the given scope is compromised; determining whether to present an alert of the given scope being compromised based on comparing the confidence score to an alert threshold; and in response to determining that the alert is to be presented of the given scope being compromised, generating and transmitting the alert, wherein scoring the detection results comprises: computing an identifier for a given detection result; retrieving an aggregate count for the given detection result, wherein the aggregate count comprises a population count indicating a total number of previously observed detections of the given behavior type and a subpopulation count of the total number of previously observed detections sharing the given identifier; incrementing the population and subpopulation counts of the aggregate count for the given detection result; calculating an anomaly score for the given detection result based on the aggregate count, wherein the anomaly score is based on a ratio between the subpopulation count and the population count for the given behavior; and associating the anomaly score with the given detection result to produce a scored detection result. receiving detection results of behaviors occurring on devices within the online service; scoring the detection results based on how anomalous the respective behaviors are within the online service; organizing the scored detection results according to scopes; applying multi-signal detection logic to a given scope to produce a confidence score indicating whether the given scope is compromised; determining whether to present an alert of the given scope being compromised based on comparing the confidence score to an alert threshold; and in response to determining that the alert is to be presented of the given scope being compromised, generating and transmitting the alert, wherein scoring the detection results comprises: computing an identifier for a given detection result; retrieving an aggregate count for the given detection result, wherein the aggregate count comprises a population count indicating a total number of previously observed detections of the given behavior type and a subpopulation count of the total number of previously observed detections sharing the given identifier; incrementing the population and subpopulation counts of the aggregate count for the given detection result; calculating an anomaly score for the given detection result based on the aggregate count, wherein the anomaly score is based on a ratio between the subpopulation count and the population count for the given behavior; and associating the anomaly score with the given detection result to produce a scored detection result. computing an identifier for a given detection result; retrieving an aggregate count for the given detection result, wherein the aggregate count comprises a population count indicating a total number of previously observed detections of the given behavior type and a subpopulation count of the total number of previously observed detections sharing the given identifier; incrementing the population and subpopulation counts of the aggregate count for the given detection result; calculating an anomaly score for the given detection result based on the aggregate count, wherein the anomaly score is based on a ratio between the subpopulation count and the population count for the given behavior; and associating the anomaly score with the given detection result to produce a scored detection result.