A device for detecting energy theft from a utility network configured to access energy data for utilities, generate energy results, identify an outlying utility in the energy results, access behavioral data, determine whether there is a likelihood of energy theft associated with the outlying utility, generate descriptive results from the behavioral data indicating the likelihood of energy theft, receive a response of whether the energy theft occurred, and refine operation of the detecting of energy theft of the device.