You are choosing an anomaly detection method for a security monitoring task and need to explain your reasoning to engineers and stakeholders.
How would you explain why you chose a specific approach for anomaly detection?