What breaks when organisations rely on anomaly detection without identity and threat context?

Why This Matters for Security Teams

Anomaly detection is useful for surfacing unexpected behaviour, but it is not a decision engine. Without identity context, threat intelligence, and asset criticality, the alert queue quickly fills with events that look unusual but are operationally normal. That creates real risk: analysts spend time on harmless deviations, while true compromise blends into the noise. The right question is not whether something is anomalous, but whether it is anomalous for that identity, that workload, and that moment in the kill chain.

This is especially important in environments where human users, service accounts, and AI agents all have execution authority. A login from a new geography may be routine for a contractor, suspicious for a finance administrator, and meaningless for a cloud job running through a controlled automation path. Guidance from the NIST Cybersecurity Framework 2.0 supports the broader point: detection must connect to governance, asset understanding, and response prioritisation, not operate as a standalone signal factory.

In practice, many security teams encounter the real failure only after a week of alert fatigue has already buried the initial compromise signal.

How It Works in Practice

Effective anomaly detection combines statistical outliers with identity, privilege, and threat context. That means enriching alerts with who performed the action, what entitlements they had, whether the action aligned with recent behaviour, and whether the event matches known attacker tradecraft. A failed impossible-travel alert is more meaningful when paired with a sudden token grant, an unusual API call pattern, or access to a high-value system.

Operationally, teams usually improve results by layering detections rather than trusting one model to decide. A practical pattern is:

• Baseline normal behaviour by identity class, not just by user population.
• Tag privileged, service, and machine identities separately from standard accounts.
• Enrich anomalies with asset value, data sensitivity, and session risk.
• Correlate with threat intel and tactics from sources such as CISA cyber threat advisories.
• Investigate sequences, not single events, so one odd action is judged in context of preceding access and follow-on activity.

This matters even more for AI systems and autonomous agents. A prompt injection attempt, abnormal tool invocation, or unexpected retrieval pattern can look like ordinary model interaction unless it is evaluated against the agent’s permissions and workflow. Current guidance suggests treating these behaviours as security events with identity provenance, not just model quality issues. MITRE’s MITRE ATLAS adversarial AI threat matrix is useful here because it frames AI abuse in attacker terms rather than generic anomalies. These controls tend to break down when telemetry is fragmented across SaaS, cloud, and endpoint tools because the correlation path is too weak to reconstruct intent.

Common Variations and Edge Cases

Tighter context-driven detection often increases engineering and tuning overhead, requiring organisations to balance better precision against data quality and integration cost. That tradeoff becomes visible in environments with mixed identity types, such as contractors, shared admin accounts, service principals, and AI agents operating under delegated access.

There is no universal standard for every anomaly model yet, but best practice is evolving toward contextual scoring rather than binary alerting. In heavily regulated or high-change environments, teams may need to accept a higher baseline of exceptions while still preserving stronger detection for privileged and high-impact actions. The key is to avoid treating all anomalies equally.

Edge cases also matter where identity is unstable or hard to verify. Short-lived credentials, device posture changes, and orchestration platforms can make normal operations look suspicious unless the detection pipeline understands the workflow. That is why the Anthropic report on the first AI-orchestrated cyber espionage campaign is so relevant: AI-driven activity can be both highly automated and highly deceptive, so anomaly scoring without identity and threat context is often too shallow to separate abuse from normal automation.

Related resources from NHI Mgmt Group

• What breaks when organisations rely on IAM without identity threat detection?
• What breaks when organisations rely on detection without enforcement?
• What breaks when merchants rely on issuer declines without adding identity context?
• What breaks when organisations rely on threat intelligence without validating controls?