Entity Baselining

Expanded Definition

Entity baselining is a behavioural reference method used in security analytics to understand what is normal for a specific entity rather than for the environment as a whole. The entity may be a human user, privileged role, service account, workload, device, API client, or source address. That distinction matters because the same event can be routine for one entity and suspicious for another. In practice, baselines are used to improve detection precision in anomaly scoring, insider risk monitoring, access review prioritisation, and identity-aware threat detection. The concept aligns closely with the outcome-focused guidance in the NIST Cybersecurity Framework 2.0, although no single standard fully defines entity baselining as a standalone control concept.

Definitions vary across vendors on how much history is needed, which features are relevant, and how quickly a baseline should adapt. Some tools treat the baseline as a static profile, while others continuously relearn it as behaviour changes. NHIMG treats the term as a detection support concept, not a guarantee of truth, because baselines can drift, overfit, or inherit bad data from compromised periods. The most common misapplication is treating a newly observed pattern as trustworthy baseline behaviour when the learning window already includes attacker activity or sparse history from a newly created identity.

Examples and Use Cases

Implementing entity baselining rigorously often introduces tuning and governance overhead, requiring organisations to balance better detection fidelity against the risk of false confidence in weak or contaminated data.

• A privileged administrator usually accesses a narrow set of management systems, so repeated access to unrelated repositories may score as anomalous and trigger review.
• A service account that normally calls a single internal API begins authenticating from a new geography or an unusual workload segment, suggesting possible token theft or automation misuse.
• A source address that normally serves one branch office suddenly generates authentication traffic across many cloud apps, indicating possible credential sharing, relay activity, or compromised remote access.
• A newly provisioned NHI with very little history is held to stricter contextual rules until enough legitimate activity exists for a stable baseline, which is consistent with identity-centric guidance in NIST SP 800-63B when assurance depends on reliable identity signals.
• An analyst compares a workload’s API usage to its historical call distribution to detect lateral movement, while excluding planned deployment windows to avoid learning maintenance behaviour as “normal.”

In environments using OWASP guidance for agentic and LLM security, baselining can also help distinguish expected tool usage from abnormal command patterns when agents have execution authority.

Why It Matters for Security Teams

Entity baselining matters because security teams rarely need a generic notion of “normal”; they need context tied to the specific thing that is acting. Without that context, behavioural detections can generate too many false positives against high-volume users or miss low-and-slow abuse against accounts that normally do very little. Baselining also supports identity governance by separating ordinary change from suspicious deviation, which is especially important for privileged access, service identities, and non-human identities that can look legitimate at the protocol level while still being abused operationally. A weak baseline can make anomaly detection brittle, particularly when access patterns shift during migrations, incident response, or automation rollout. The concept is also relevant to NIST Zero Trust Architecture, because trust decisions depend on continuously evaluated context rather than a one-time login event.

For governance, the key question is whether the baseline reflects actual authorised behaviour or merely historical noise. Organisations typically encounter the operational cost of poor baselining only after an investigation is flooded with false alerts or a compromised identity remains hidden inside “normal” activity, at which point entity baselining becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• When should organisations use entity-level isolation for access reviews?
• What breaks when compliance stays entity-based instead of activity-based?
• Who is accountable when a business entity is approved with weak KYB evidence?
• Non-Person Entity (NPE)