Cyber threat defense systems and methods are provided. The system includes a network module, an analyzer module and a classifier. The network module ingests network data, which is provided to one or more machine learning models included in the analyzer module. Each machine learning model identifies metrics associated with the network data and outputs a score indicative of whether anomalous network data metrics are caused by a cyber threat. These output scores are provided to the classifier, which determines a probability that a cybersecurity breach has occurred.