There’s a wealth of knowledge and intelligence available from an application’s point of use. Crowdsourcing detections can be as simple as asking the user to confirm whether they did actually just log in and from where. Here, time can be your ally rather than your enemy.
Rarely are all the elements for confident decision making located in a single silo, repository, or team. Equally, security patterns that are mandated for accessing disparate or remote data sources may be a mixture of 'push' or 'pull' depending upon the boundaries, zones, or enclaves to be crossed.