A record of normal device communication patterns, including peers, ports, protocols, timing and traffic volume. Security teams use it to spot deviations, generate least-privilege network rules and reduce the chance that a misplaced or compromised device can move beyond its intended role.
What a Flow Baseline Captures
A flow baseline is a reference picture of normal network behaviour for a device or service. It records who the subject talks to, which ports and protocols it uses, when it usually communicates, and how much traffic it typically generates.
The value of the baseline is not the raw data alone, but the pattern it establishes. Once normal communication is understood, security teams can distinguish expected behaviour from new routes, unusual destinations, or sudden changes in volume that may indicate misuse, misconfiguration, or compromise.
Why Flow Baselines Matter for Segmentation
Flow baselines help turn broad network visibility into a practical control. They are often used to define least-privilege network rules, because the observed pattern shows which connections are actually necessary rather than assumed to be necessary.
That makes the baseline especially useful when organisations want to reduce lateral movement. If a device is misplaced, exposed, or compromised, a well-built baseline can show where its traffic should stop and where enforcement should be tightened.
How a Baseline Is Built and Maintained
Good baselines come from observation over time, not from a single snapshot. Teams usually need to account for business cycles, maintenance windows, batch jobs, remote access, failover paths, and other legitimate exceptions so that the baseline reflects real operations rather than an idealised version of them.
They also need a reliable asset view. A flow baseline is only meaningful when the devices, services, and network boundaries being observed are known and current. Otherwise, abnormal traffic can be missed or wrongly treated as normal because the environment itself is poorly understood.
As environments change, the baseline must be reviewed and refreshed. A stale baseline can become a false sense of control, especially when new services are added, responsibilities shift, or a device changes role without the monitoring logic being updated.
What Flow Deviations Usually Tell You
Deviation does not always mean an incident, but it is a signal that something deserves attention. A new peer, a different port, an unexpected protocol, or a sudden change in timing can point to software drift, shadow services, unauthorized tools, or attacker activity.
Flow data is also useful after containment or patching, because it can help confirm whether a device resumed only its expected behaviour or continued making suspicious connections. CIS Benchmarks are a useful companion reference when translating observed communications into hardened configuration and segmentation choices.
Risk and Threat Considerations
Flow baselines matter because they expose the gap between intended network behaviour and actual network behaviour. If the baseline is missing, stale, or too broad, organisations can fail to notice anomalous communication and can leave unnecessary pathways open for lateral movement or data exfiltration.
Failure mechanism: An attacker or misplaced device uses permitted-but-unnecessary network paths, then blends into ordinary traffic patterns long enough to evade coarse monitoring and move beyond its intended segment.
Impact: The result can be internal spread, broader service compromise, or traffic paths that remain open even after a device’s role has changed or been abused.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | Flow baselines define expected network communication paths and segmentation boundaries. |
| Recommendation — Compare observed flows to approved network patterns and tighten segmentation around necessary communications. | ||
| NIST CSF 2.0 | PR.PS-05 — Network Integrity | Flow baselines support integrity of network communications by revealing abnormal device behaviour. |
| Recommendation — Monitor network flows for deviations and investigate unexpected peers, ports, protocols, or volumes. | ||
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | Flow baselines help define and enforce controlled network boundaries and permitted traffic paths. |
| Recommendation — Use boundary protection controls to restrict devices to the communications their baseline justifies. | ||
Practitioner Guidance
Why practitioners should care: A flow baseline is only useful when it is tied to an actual enforcement decision. If the observed pattern does not inform segmentation, allowlisting, or alert tuning, it becomes documentation rather than control.
What to watch for: Treat the baseline as a living reference that should be updated when business processes, cloud placement, device roles, or approved communication paths change. The safest baseline is the one that still matches how the environment actually operates.
Practitioner takeaway: Use the baseline to narrow trust, not just to describe traffic, because the control value comes from acting on the deviations it reveals.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org