A behavioural baseline is the expected pattern of activity for a user, device, workload, or agent under normal conditions. In identity security, it is built from telemetry such as login times, access paths, command patterns, and data use, then used to detect anomalies that may indicate compromise, misuse, or policy drift.
What behavioural baselines tell you
A behavioural baseline is not a fixed rule set. It is a living picture of how a subject normally behaves, so security teams can spot meaningful deviation without treating every unusual event as hostile.
In practice, the value of the baseline depends on the quality of the telemetry behind it. If the signals are sparse, noisy, or poorly segmented, the baseline becomes too broad to be useful and too narrow to be trusted.
What a behavioural baseline is built from
A strong baseline combines several dimensions of normal activity: when a subject typically acts, where it connects from, which resources it touches, and what kinds of commands, transactions, or data movements are routine. The more context-rich the telemetry, the more usable the baseline becomes.
Behavioural baselines are especially useful when normal activity is not uniform. A developer, a service account, and an autonomous agent can all have very different “normal” patterns, even if they use the same systems.
For agent activity, the baseline often includes tool use, sequence patterns, and decision rhythm. NHIMG’s AI Agent Observability, Audit and Incident Response Guide is useful here because it ties observed behaviour to attribution, incident triage, and kill-switch thinking.
How behavioural baselines support detection
Baselines matter because many compromises do not begin with an obvious alarm. Instead, they appear first as subtle deviations: access at an unusual hour, a new network path, an abnormal command chain, or a new pattern of data access that does not fit the established profile.
That makes the baseline a detection aid, not a verdict. A deviation is only a signal that deserves review, because legitimate change, role shifts, maintenance work, and automation updates can also move the pattern.
Used well, the baseline helps analysts reduce false positives while still surfacing misuse, compromise, and policy drift. Used poorly, it can create blind spots by normalising risky behaviour that should have been investigated earlier.
For identity-adjacent monitoring, a behavioural baseline often works alongside audit trails and anomaly detection. It is most useful when paired with controls that can confirm, challenge, or revoke unusual activity rather than merely observe it.
Where behavioural baselines fail
Behavioural baselines can drift as businesses change, teams reorganise, and workloads evolve. When that drift is not managed, the baseline quietly stops representing reality and loses both detection value and analyst trust.
They can also be misleading when the “normal” pattern already contains excessive privilege, shared access, or weak segregation of duties. In that case, the baseline may faithfully describe an unhealthy state instead of a secure one.
Baselines are also vulnerable to overfitting. If the model is too narrow, it will flag benign variation. If it is too broad, it will absorb suspicious behaviour into normality and miss the very signal it was meant to catch.
External baselines for hardening and control consistency are a useful contrast, and CIS Benchmarks provide a useful reference point for what a secure configuration baseline looks like when the subject is system state rather than behaviour.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-01 — Security Continuous Monitoring | Behavioural baselines underpin continuous monitoring by defining normal activity to compare against anomalies. |
| ID.AM-01 — Physical devices and systems within the organization are inventoried | A behavioural baseline depends on knowing which users, devices, workloads, or agents are in scope for normal activity. | |
| DE.AE-02 — Anomalous Activity Detected | Baselines exist to make anomalous activity visible by contrasting normal and abnormal patterns. | |
| Recommendation — Use continuous monitoring to compare observed behaviour against defined baselines and escalate material deviations. Maintain an accurate inventory so baseline logic is anchored to the correct subjects and telemetry sources. Define anomaly thresholds that surface meaningful deviation without overwhelming analysts with noise. | ||
| MITRE ATT&CK | T1078 — Valid Accounts | Behavioural baselines help detect misuse of legitimate accounts that behave differently from their normal profile. |
| T1059 — Command and Scripting Interpreter | Command patterns are a core input to behavioural baselines and help spot suspicious execution chains. | |
| Recommendation — Hunt for account behaviour that deviates from expected login times, access paths, and command patterns. Baseline normal command execution patterns and investigate unusual interpreter or script usage. | ||
Practitioner Guidance
Why practitioners should care: A behavioural baseline is only valuable when it reflects both normal operations and acceptable security posture. If it is built from incomplete telemetry or accepted risk, it will normalise the wrong thing and weaken detection quality.
What to watch for: Treat persistent drift, sudden pattern changes, and unexplained access paths as signals to re-evaluate the baseline, not as proof of compromise. The key judgement is whether the new behaviour is a legitimate change that should be learned, or an anomaly that should be contained.
Practitioner takeaway: Behavioural baselines should be reviewed as living detection assets, not static policy artifacts. Their value comes from continuous validation against real activity, trusted ownership, and timely response to meaningful deviation.