An apparatus includes a memory and one or more processors operably connected to the memory. The one or more processors are configured to receive data collected from a process facility system, detect anomalies for field device or process failures associated with the process facility system that are not monitored by alarms, detect leading indicators for field device or process failures that are monitored by alarms, and monitor the process facility system to detect further anomalies and leading indicators before failures occur.