Baseline-based detection struggles when attackers imitate legitimate users or operate inside normal patterns. Insider abuse, patient threat actors, and stolen credentials can all look routine to tools that depend on behavior comparisons. Deception closes that gap by placing assets no real user should touch, turning a single interaction into an immediate and high-confidence alert.
Why Baseline Detection Fails Against Blended Adversary Behaviour
Baseline-based detection is strongest when the attacker looks unusual. The problem in healthcare is that modern threats often do the opposite: they borrow valid accounts, work during normal hours, and move through systems that clinicians and admins use every day. That makes the alerting model blind to activity that is malicious in intent but ordinary in appearance.
In practice, this means the control is not broken because it lacks data, but because its core assumption is too narrow. If a threat can stay inside the statistical “normal” zone, the tool may classify it as routine access instead of hostile activity. The result is a gap between observed behaviour and actual risk.
What Attack Patterns Blend Into Normal Healthcare Activity
Healthcare environments are especially vulnerable to lookalike behaviour because legitimate work already involves broad access, shared workflows, and time-sensitive exceptions. Stolen credentials, insider abuse, and patient threat actors can all use valid pathways that resemble approved activity, especially when the attacker avoids noisy actions like mass downloads or obvious privilege escalation.
Baseline logic also struggles when an adversary is patient. An attacker may take small actions over time, pivot only when necessary, and keep within expected user, device, or location patterns. That makes detection dependent on the absence of context, which is exactly where baseline-only methods are weakest. For deeper case patterns, see The 52 NHI Breaches Report.
That is why defenders often pair behavioural detection with threat-focused signals from CISA cyber threat advisories and adversary technique mapping such as MITRE ATT&CK Enterprise Matrix. Those sources help teams reason about intent, not just similarity to the past.
Why Deception Changes the Detection Model
Deception works because it changes the question from “does this look normal?” to “why did anything touch this object at all?” A decoy record, fake credential, or honey resource should have no legitimate operational use, so one interaction can be treated as highly suspicious without waiting for a pattern to emerge.
That shifts defenders away from weak behavioural inference and toward high-confidence validation. Instead of trying to prove maliciousness from subtle deviations, teams create assets that should never be accessed by a real clinician, patient, or system process. When those assets are touched, the signal is not probabilistic, it is direct. Practitioner teams can compare that approach with baseline hardening guidance in CIS Benchmarks and defensive detection resources from MITRE D3FEND.
For attackers who rely on legitimacy, that matters. Deception reduces dwell time because it does not require repeated misuse before the control becomes useful. It gives defenders an early, high-signal tripwire at the exact moment the adversary crosses a boundary that normal business activity should never cross.
Risk and Threat Considerations
When baseline detection is the main control, the biggest risk is false normality: valid credentials, routine workflows, and shared clinical access can hide reconnaissance, lateral movement, and low-and-slow misuse. The danger is not just missed alerts, but delayed containment after the attacker has already gained trust inside the environment.
Failure mechanism: The detection logic overweights historical similarity and underweights intent, so credential theft, insider abuse, and patient threat activity can remain invisible until a later, noisier stage.
Impact: A healthcare team may miss early compromise signals, extend dwell time, and allow access to sensitive records or systems before the intrusion is recognised.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1078 — Valid Accounts | Baseline evasion here depends on legitimate account use. |
| T1021 — Remote Services | Blended lateral movement often uses ordinary administrative access paths. | |
| Recommendation — Map access patterns to Valid Accounts and hunt for abuse of trusted credentials. Inspect remote service use for lateral movement that looks like routine administration. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Deception and behavioural detection both depend on usable telemetry and alert fidelity. |
| Recommendation — Centralise and review logs so suspicious decoy access can be detected and escalated quickly. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | This topic is about detecting hostile activity that normal baselines may miss. |
| AC-6 — Least Privilege | Reducing routine access narrows what can look normal to an attacker. | |
| Recommendation — Apply SI-4 monitoring to detect anomalous access to decoy assets and trusted pathways. Limit privileges so stolen credentials cannot move freely inside expected user behaviour. | ||
Practitioner Guidance
What to prioritise: Treat baseline detection as one layer, not the decision point. Pair it with deception where you need immediate confirmation that an actor touched something no legitimate workflow should ever reach.
What to verify: Confirm that decoy objects are truly non-operational, non-discoverable through normal workflows, and monitored with response runbooks that can act on a single touch. If a fake asset could plausibly be used in day-to-day work, the signal quality drops fast.
Common mistake: Teams often tune behavioural detection harder instead of changing the detection model. That can reduce noise, but it does not solve the core problem when adversaries are intentionally blending in.
Practitioner takeaway: The goal is not to make normal activity noisier, it is to create at least one detection path that an attacker cannot imitate without exposing themselves.
Related resources from NHI Mgmt Group
- What breaks when security teams rely on indicator-based detection for modern browser attacks?
- What breaks when security teams rely on signature-based phishing detection alone?
- What breaks when security teams rely on signature-based detection for memory poisoning attacks on AI agents?
- What breaks when healthcare teams rely on provisioning-time access for AI systems touching ePHI?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 26, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
