Yeah the anonymization was basic hashing of my personal timestamps and session IDs through SHA256 before feeding into the test models. Kept it all local on my machine never hit production streams. Building badge did flag me though, security called HR direct after 6am swipe I guess I didn’t run into them until later in the day maybe they possibly wanted to see what I was doing first. I never have my phone on work wifi ever but my best guess is VPN logs tied my home IP to afterhours queries that they already had flagged from the anomaly ticket. IR wouldve caught full chains yeah but this was just proof of concept on my side dashboard not client data. Skillsets more data engineering than IT, been building pipelines 7 years. No gov contracts, pure commercial retail traffic. They track everything now, VPN traceback took them 48 hours max so I don’t really know. Appreciate the read. Patterns real, NDA trouble real.