Surprisal

How surprisal works in sign-in analysis

Surprisal converts a learned expectation into a ranking signal, so events that are rare for a specific organisation can rise to the top without treating every deviation as equally important. That makes it useful for prioritising review when the goal is to surface logins that are unexpected in local context.

Because it is model-relative, surprisal is not the same as a generic anomaly score. A sign-in can look unusual in the abstract yet still be ordinary for a particular team, geography, device pattern, or business process if the model has learned that behaviour as normal.

Why surprisal is useful for identity and access monitoring

In sign-in monitoring, surprisal helps focus analyst attention on the events most likely to warrant scrutiny. It is especially valuable when organisations have large volumes of routine authentication activity and need a way to rank what is most out of character for their own environment.

This makes surprisal a supporting mechanism for authentication monitoring, not a replacement for identity controls. It can help highlight suspicious access patterns, but the security value still depends on having reliable identity telemetry, baseline quality, and a response path for accounts that show unusual behaviour.

What surprisal does and does not tell you

High surprisal means the event is improbable under the model’s learned behaviour, but it does not by itself prove compromise, fraud, or malicious intent. The score is only as good as the history and features used to train it, so it can miss new legitimate patterns or overstate rare but harmless activity.

That is why surprisal works best as a prioritisation layer. Practitioners still need to inspect the surrounding context, such as device reputation, location shifts, session continuity, and whether the event aligns with known user or service behaviour.

Using surprisal responsibly in security operations

Surprisal should be calibrated against the organisation’s own operating reality, not against a theoretical idea of normal. If the model is trained on noisy, incomplete, or stale data, it may rank the wrong events highly and create unnecessary analyst work.

It is also important to treat surprisal as one signal among several. The most useful deployments combine it with corroborating identity evidence so that unexpected logins are investigated in context rather than escalated automatically on score alone.