The organization has implemented a detective control. Detective controls are designed to identify and alert when a security incident occurs. The scenario describes a monitoring system that flags unusual behavior, which aligns with the detection and alerting function of a detective control. Preventive controls aim to stop incidents from occurring before they happen, which is not the focus in this scenario. Corrective controls are instituted to limit the damage after an incident has occurred, which is again not the main function described. While compensating controls provide an alternative measure if primary controls fail or are not feasible, the scenario directly mentions the implementation was a response to a previous undetected breach, indicating it is a primary monitoring solution, not a compensatory one.