Runtime Baseline

What Runtime Baseline Means in Practice

A runtime baseline is not just a documented configuration state, it is the expected operating profile of a live system. It defines what “normal” looks like while the system is running, so defenders can compare real behaviour against an approved reference point.

That matters because many compromises first appear as small deviations rather than obvious outages. A process starts unexpectedly, a permission set changes, or a service begins speaking to a new destination, and the baseline gives teams a way to notice that drift quickly.

Why Runtime Baselines Matter for Detection

The value of a runtime baseline is in comparison. Security teams use it to identify whether identities, processes, ports, service relationships, or configuration values still match the approved state, especially in environments where change is frequent and manual inspection is too slow.

That makes the baseline a detection aid as much as a governance artefact. It supports rapid triage by showing what is expected, which helps separate ordinary operational change from suspicious activity that may deserve immediate investigation.

What a Runtime Baseline Typically Covers

In a mature security program, a runtime baseline often includes running processes, active network connections, loaded services, scheduled tasks, privileged identities in use, and key configuration settings. The scope should be broad enough to reflect how the system behaves, not just how it was originally deployed.

For cloud-native and containerised environments, the concept extends to orchestration state, container runtime behaviour, and control-plane expectations. NIST’s NIST SP 800-190 Container Security is useful here because it treats runtime behaviour as part of the security problem, not merely the image or build stage.

How Organisations Use It to Control Drift

Runtime baselines are most effective when they are treated as living references. Teams compare observed state to the baseline continuously or near-continuously, then decide whether the difference is an approved change, an operational anomaly, or evidence of compromise.

That also means the baseline must be kept current. If it drifts too far from reality, it stops being a reliable standard and starts creating alert fatigue, missed detections, or false confidence in the environment’s state.

Risk and Threat Considerations

Runtime baseline gaps create a visibility problem, because attackers often thrive in the space between approved configuration and actual behaviour. A compromised system may still appear functional while quietly running new processes, maintaining hidden access, or using privileges in ways the baseline would flag if it were current.

Failure mechanism: If expected runtime behaviour is not defined or monitored accurately, unauthorised process changes, privilege changes, and suspicious network activity can blend into normal operations and delay detection.

Impact: That delay can extend dwell time, increase the chance of lateral movement, and make post-incident reconstruction harder because the organisation loses a trustworthy reference for what the system was supposed to be doing.

Practitioner Guidance

What to watch for: The most useful runtime baselines are the ones tied to specific detection decisions, such as which identities should be active, which services should be listening, and which network paths should never appear during normal operation. If those elements are too broad, the baseline becomes hard to operationalise.

Practitioner takeaway: Treat the runtime baseline as a detection control, not a static configuration document. It should help you answer one question quickly: is the system behaving as the organisation approved?

Related resources from NHI Mgmt Group

• What breaks when containers are allowed to run without baseline runtime policy?
• What is the difference between baseline policy discovery and ongoing runtime enforcement for cloud workloads?
• Why do runtime controls matter more than step-by-step baseline checks for AI agents?
• Runtime Behaviour Baseline