Techniques for detecting an anomaly in a PON include generating an optical profile for the PON based on characteristics of network light level signals, collected over a first time period, delivered over the PON, and generating an optical profile for a customer based on characteristics of customer light level signals, collected over the first time period, delivered over the PON to or from an ONT for the customer. The techniques also include obtaining customer light level signals collected over a second time period, and detecting an anomaly in the PON for the customer in response to determining that the customer light level signals collected over the second time period deviate from the optical profile for the customer or the optical profile for the PON by more than a threshold amount.