The Missing Half of Enterprise Fraud Detection

The most important conversation in enterprise AI right now is not about which model is most powerful. It is about how autonomous systems make decisions, and what happens when they get it wrong.

Salesforce reported in its Q4 FY2026 earnings that Agentforce has generated $800 million in recurring revenue, up 169 percent year over year, with 2.4 billion Agentic Work Units delivered to date. These are not moments where AI was reasoning in the background. These are moments where AI was completing real work. Snowflake is building its entire 2026 strategy around connected agentic experiences grounded in governed data. OpenAI’s Frontier platform is positioning itself as the operating system for enterprise agent fleets.

Every major platform is racing toward the same destination: AI that does not just advise but acts. And every one of them is navigating the same foundational question that sits at the core of how Fortza was designed.

How does an autonomous system decide when to act with certainty and when to act with probability, and why does the difference between those two things determine whether the output can be trusted?

At Thanawalla Digital, we call this the deterministic versus non-deterministic distinction. It is not a technical preference. It is the architectural decision that determines whether a fraud detection system can be trusted, explained, and defended at scale.

Two kinds of fraud.

The fraud landscape entering Q2 2026 has split into two distinct populations that require fundamentally different responses.

The first population is blatant actors who exploit known technical gaps. A transaction submitted from a confirmed fraud geography fires a flag immediately. An address that fails validation triggers an automatic block. A customer profile that matches a flagged identity in a known database produces a definitive, auditable stop. These cases do not require inference. They require certainty, speed, and accountability.

The second population is sophisticated actors who operate inside the lines. They study detection systems, build synthetic identities that pass KYC checks because the documents are AI-generated and convincing, and accumulate behavioral history over weeks or months before executing. They engineer every individual signal to look clean while the pattern beneath them tells a different story.

PwC’s February 2026 analysis of deepfakes and synthetic identities found that these actors are now specifically engineering submissions to pass every individual check while the convergence of those signals reveals what no single check can.

Two kinds of detection.

Deterministic systems operate on fixed logic. If a condition is true, the system executes a defined response. The address either verifies or it does not. The transaction originates from a confirmed fraud geography or it does not. There is no gray area, no inference, and no interpretation. When the condition is met, the response fires every time, reliably, and in a way that can be audited and defended.

Non-deterministic systems operate on probability and inference. They analyze patterns, behavioral signals, and contextual cues to make a judgment about what is likely true rather than what is definitively proven. They can flag a transaction that has never been seen before because the combination of signals resembles fraud even if no single signal confirms it. They detect intent, behavioral drift, and emerging attack patterns that no rule set has ever been written to catch, which is exactly why they exist alongside deterministic logic rather than instead of it.

Why choosing one is not enough.

A purely deterministic fraud system is fast, auditable, and completely blind to anything it has not already seen. It catches repeat fraud patterns reliably and misses every novel attack comprehensively. In a fraud environment where tactics evolve faster than rule sets can be updated, that blind spot compounds into material losses every quarter.

A purely non-deterministic system is adaptive and intelligent but ungovernable on its own. It produces outputs that cannot be explained to a compliance team, contested in a chargeback dispute, or defended in a regulatory review. It generates false positives that block legitimate customers and creates chargeback exposure of its own. Without deterministic anchors, probabilistic inference has no floor and no accountability.

This is the same tension every enterprise AI platform is navigating right now. Salesforce introduced deterministic guardrails into Agentforce specifically because agents that can act autonomously need rule-based controls around what they are allowed to do. As CIO.com reported in January 2026, Salesforce’s own advisors stated that deterministic controls are required not just to govern AI behavior but to defend it. The emerging standard across enterprise AI is deterministic orchestration with bounded probabilistic components, not one approach in isolation.

How Fortza is built.

Fortza’s architecture applies 13 layers across both categories simultaneously. Deterministic layers handle the conditions where certainty is available and required. Address validation either confirms or blocks. Geolocation hotspot analysis fires when a transaction matches a confirmed abuse geography. Historical customer data flags when behavior deviates from an established baseline. These layers are fast, definitive, and audit-ready, and when they fire there is no ambiguity about why.

Non-deterministic layers handle the conditions where inference is the only viable approach. The encoder-decoder language model analyzes the full transaction context to detect patterns associated with fraud that no rule has ever been written to catch. Psychosocial analysis interprets behavioral signals that suggest manipulation or fraud rationalization. Anomaly detection flags statistical deviations that do not match user or cohort norms even when they have never appeared before.

What makes Fortza’s output trustworthy is not that either layer type works in isolation but that both work in conversation with each other. A transaction that passes every deterministic check but triggers multiple non-deterministic flags produces a different risk assessment than one that fails a deterministic layer outright. The system surfaces what the convergence of signals suggests, with a plain-language explanation of exactly which layers contributed and why, so your team receives a scored, explainable risk determination they can act on, defend, and audit.