Clustering and its evaluation, dimensionality reduction, density and isolation methods, and detecting anomalies with no labels to learn from.
3 questions in Machine Learning.
Model what normal looks like and score deviation from it, using distance or density methods, an isolation forest, or reconstruction error from an autoencoder. Then set the threshold from how many alerts the team can investigate per day, because an unlabelled score distribution cannot tell you where to cut.
Combine internal geometry measures such as silhouette with stability under resampling, then accept that neither picks k for you. A clustering is good when the segments are separable, reproducible on a resampled dataset, and distinct on a variable the business will act on.
It helps when features are genuinely redundant, when a downstream method needs dense low-dimensional input, or when you must compress for cost. It hides the problem when PCA's linearity assumption discards the signal, and when a t-SNE or UMAP picture is used as evidence for a modelling decision it cannot support.