A dynamic baseline is a behavioural reference point built from a user’s role, peers, historical activity, and data sensitivity. It helps security teams judge whether a current action is expected or suspicious in context, rather than relying on a fixed threshold that ignores normal variation.
Expanded Definition
A dynamic baseline is a context-aware behavioural reference used to evaluate whether activity is normal for a person, service, workload, or environment at a given moment. Unlike a fixed rule or static threshold, it changes as role, timing, peer group, asset sensitivity, and historical behaviour change. In security operations, that makes the concept useful for spotting deviations that are meaningful in context, not just mathematically unusual.
Definitions vary across vendors, especially where the term overlaps with anomaly detection, user and entity behaviour analytics, and risk scoring. NHI Management Group treats dynamic baselines as a governance concept as much as a detection method: the baseline is only useful if teams can explain what data informed it, who approved its use, and how it is recalibrated. That matters when the subject is a human account, a NIST Cybersecurity Framework 2.0 aligned control process, or a non-human identity acting through automation. The most common misapplication is treating a dynamic baseline as a permanent truth, which occurs when teams fail to reset it after role changes, mergers, compromise, or seasonal business shifts.
Examples and Use Cases
Implementing dynamic baselines rigorously often introduces tuning overhead and review complexity, requiring organisations to balance better contextual detection against the cost of false positives and analyst fatigue.
- A finance approver normally exports small report sets during business hours, but suddenly downloads large volumes of sensitive records at night. The baseline flags the pattern because the context has shifted beyond peer norms.
- An NHI used by a CI/CD pipeline routinely calls a fixed set of APIs. If it begins accessing secrets it has never touched before, the deviation is more meaningful than a simple request-count threshold.
- A privileged administrator logs in from a known location, yet starts performing actions associated with a different team. A dynamic baseline helps distinguish legitimate cross-functional work from account misuse.
- A cloud workload usually connects to internal services only, but after a configuration change it begins reaching internet endpoints. The baseline must be recalibrated, or the alerting logic will misclassify normal change as suspicious activity.
For teams building behaviour-driven controls, the NIST Cybersecurity Framework 2.0 is a useful anchor for framing continuous monitoring and response expectations, even though it does not define the term itself.
Why It Matters for Security Teams
Dynamic baselines matter because many high-value threats look normal at first glance. A stolen session, an abused service account, or an over-permissioned AI agent can operate within expected technical limits while still violating intent. When security teams rely on static thresholds alone, they miss abuse that blends into routine business activity and they overload analysts with alerts that lack business context.
The identity connection is especially strong for privileged users, service accounts, and NHI estates, where access patterns are shaped by role, workload, and automation schedules. A well-managed baseline can support NIST Cybersecurity Framework 2.0 style monitoring, but only if it is paired with reviewable policy, change control, and ownership. In AI-enabled environments, dynamic baselines also help distinguish legitimate agent execution from prompt-injected or hijacked behaviour, though no single standard governs this yet.
Organisations typically encounter the impact of a weak baseline only after an incident review shows that the warning signs were present but dismissed as normal, at which point the baseline becomes operationally unavoidable to repair.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST AI RMF, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.AE-1 | Defines anomalous events by comparing observed activity against expected behaviour. |
| NIST AI RMF | Supports governance of adaptive AI-enabled detection and risk assessment practices. | |
| OWASP Non-Human Identity Top 10 | Relevant to NHI behaviour profiling and detection of abnormal service-account activity. | |
| NIST Zero Trust (SP 800-207) | Zero trust relies on continuous evaluation of context and trust signals. | |
| NIST SP 800-63 | Digital identity assurance depends on contextual signals and ongoing risk evaluation. |
Treat abnormal authentication and session behaviour as signals for step-up checks or re-verification.
