Baseline Monitoring

Expanded Definition

Baseline monitoring is the practice of comparing observed NHI, service account, and agent activity to an expected pattern of normal behaviour so that deviations can be evaluated in context. In NHI operations, the baseline is not just a dashboard average. It should reflect credential use, token exchange frequency, API call timing, privilege scope, source location, and tool invocation patterns. Because agentic systems can generate legitimate bursts of activity, definitions vary across vendors on what counts as normal, and no single standard governs this yet. Teams usually anchor the concept in broader monitoring and detection discipline, such as the NIST Cybersecurity Framework 2.0, then adapt it to machine identity behaviour rather than human login patterns.

At NHIMG, baseline monitoring is treated as a living control, not a one-time configuration. It must be recalibrated when workloads are redeployed, when agents are granted new tools, or when secrets rotate. The most common misapplication is treating a short observation window as a stable baseline, which occurs when teams assume initial proof-of-value traffic represents steady-state production behaviour.

Examples and Use Cases

Implementing baseline monitoring rigorously often introduces alert-tuning overhead, requiring organisations to weigh faster anomaly detection against the cost of maintaining accurate behavioural models.

• A service account that normally reads one storage bucket starts enumerating dozens of internal APIs after a new deployment, indicating possible privilege expansion or abuse.
• An AI agent that issues predictable tool calls during business hours suddenly begins authenticating from an unfamiliar region, suggesting a compromised token or workflow drift.
• A CI/CD bot usually writes to a single repository but begins creating secrets in multiple pipelines, which can signal misuse of automation privileges.
• Security teams compare observed activity against lifecycle expectations described in the NHI Lifecycle Management Guide and validate whether access patterns still match the intended role.
• Monitoring rules are refined using identity risk themes highlighted in Top 10 NHI Issues, especially when over-privilege or missing rotation changes the expected pattern of use.

For implementation guidance, teams often pair these baselines with identity telemetry expectations in the NIST Cybersecurity Framework 2.0 so that normal behaviour is documented before detection logic is enforced.

Why It Matters in NHI Security

Baseline monitoring matters because most NHI compromise does not begin with a dramatic failure. It starts with small behavioural shifts that are easy to miss when service accounts, secrets, and agent permissions are already sprawling across environments. NHIMG research shows that only 5.7% of organisations have full visibility into their service accounts, and 45% cite inadequate monitoring and logging as a top cause of NHI-related attacks. That combination means defenders often lack both the data and the discipline to notice subtle deviation early. The issue is especially acute for third-party OAuth connections, agentic workflows, and long-lived secrets that continue operating after ownership changes.

When baseline monitoring is absent, teams cannot distinguish intended automation from malicious persistence, and overreaction becomes as likely as underreaction. The concept also supports stronger governance by showing whether a control is actually functioning after a change, rather than merely existing on paper. Practitioners should connect this work to the Ultimate Guide to NHIs - Key Challenges and Risks when assessing exposure from excessive privilege, secrets sprawl, and weak rotation. Organisations typically encounter the need for baseline monitoring only after an investigation reveals that suspicious activity looked normal for weeks, at which point the term becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• What do security teams get wrong about baseline monitoring for autonomous workloads?
• What is NHI behaviour monitoring and what does it detect?
• What is the difference between code scanning and runtime identity monitoring?
• Why is continuous monitoring important for AI agents?