determining, by a device, a criticality of each of a plurality of endpoints in a network, based on network telemetry data regarding the network, wherein the criticality of each of the plurality of endpoints corresponds to a severity of consequences an anomaly would have respectively on each of the plurality of endpoints as compared to other endpoints of the plurality of endpoints;

translating, by the device, a plurality of anomaly detection models available for deployment to the network and their metadata into a set of adjustable resources;

generating, by the device, an anomaly detection deployment strategy for the network by selecting a set of one or more of the plurality of anomaly detection models for deployment to one or more execution points in the network, based on the criticality of each of the plurality of endpoints and on the set of adjustable resources; and

causing, by the device, the set to be deployed to the one or more execution points in the network, in accordance with the anomaly detection deployment strategy.