API6 attacks are invisible in security logs (no 401s, 403s, or 429s). The signal lives in business data:

• Inventory depletion rate: 10,000 tickets selling out in 15 seconds on a normal-traffic day. Historical baseline: 45 minutes. Anomaly.

• Referral redemption velocity: 500 referral signups in one hour from a campaign that normally generates 50/day. Anomaly.

• Account creation spike: 2,000 new accounts registered in 10 minutes before a presale. Anomaly.

• Cart abandonment pattern: 80% of carts abandoned within 30 seconds of item addition during a limited sale. Anomaly (bots holding and then abandoning).

• Geographic concentration: 70% of presale registrations from one city. Anomaly (proxy farm).

API6 monitoring bridges security, product, and fraud teams. Security teams monitor server metrics. Product teams own business metrics. Fraud teams own financial impact metrics. Someone needs to own the combination. Ideally: real-time dashboards that all three teams can see, with alerts that fire when business metrics deviate from baseline during sensitive events.