Pattern of life

Expanded Definition

Pattern of life is the behavioural baseline for a specific non-human identity in a specific system context. In NHI operations, it captures when an identity usually runs, which services it touches, what tokens or roles it uses, and the sequence of actions it normally performs. That baseline is then compared with live activity to identify drift, misuse, or compromise.

Definitions vary across vendors because some products treat pattern of life as pure anomaly detection while others include policy-aware context such as workload ownership, deployment windows, and dependency graphs. In practice, the term is most useful when it is tied to identity-specific expectations rather than generic traffic statistics. That distinction matters because the same API call can be normal for one service account and suspicious for another. A sound approach aligns the concept with broader guidance from the NIST Cybersecurity Framework 2.0 and with identity telemetry used in NHI governance.

The most common misapplication is treating aggregate system behaviour as the baseline, which occurs when teams model an environment instead of modelling a single identity in its real operating context.

Examples and Use Cases

Implementing pattern of life rigorously often introduces tuning overhead, requiring organisations to weigh detection fidelity against the cost of maintaining clean identity context.

• A CI/CD service account normally deploys to staging during business hours, then suddenly requests production secrets at 2 a.m., prompting review of whether the credential was reused or stolen.
• An API key associated with a partner integration usually reads a narrow set of endpoints, but begins enumerating unrelated resources, which can indicate abuse or privilege escalation.
• A workload identity that regularly authenticates from one cluster starts appearing from a different region after a deployment, suggesting a possible token leak or misrouted automation.
• After a supply chain event such as the SpotBugs Token GitHub Supply Chain Attack, defenders often compare historical identity behaviour to current access patterns to separate expected automation from attacker movement.
• For organisations following NIST Cybersecurity Framework 2.0, pattern of life data can support detection and response by making service-account anomalies easier to triage.

NHI Management Group research shows that only 5.7% of organisations have full visibility into their service accounts, which makes identity-specific baselines difficult to establish and even harder to maintain over time. The same visibility gap appears when legacy tokens, shadow automation, or third-party integrations keep generating legitimate-looking activity. A second reference point is the GitHub Personal Account Breach, which illustrates how compromised access can blend into routine developer and automation behaviour until the pattern shifts enough to be noticed.

Why It Matters in NHI Security

Pattern of life matters because NHI compromise rarely looks dramatic at the start. Attackers often imitate the cadence of a legitimate workload, reuse approved tooling, and operate inside normal maintenance windows so their activity does not trip simple allow-list checks. When defenders understand the expected rhythm of an identity, they can detect credential misuse, lateral movement, and over-permissioned automation earlier.

It also strengthens governance. A well-maintained baseline can reveal stale service accounts that still behave as though they are active, tokens that are used from impossible locations, or roles that are only exercised during unusual change events. Those signals become especially important in environments with secret sprawl, third-party exposure, or weak offboarding controls. The operational lesson is simple: when an NHI behaves outside its historical profile, the issue may be compromise, misconfiguration, or both, and all three demand different responses.

Organisations typically encounter the full operational impact only after a secrets leak, a failed rotation, or an unexpected incident review, at which point pattern of life becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• What is the difference between pattern matching and AI-native classification for sensitive data?
• What breaks when organisations use one Azure identity pattern for every workload?
• Why do standing NHI credentials remain such a high-risk pattern?
• How should life sciences teams govern metadata for regulated submissions?