Behavioral analytics in security builds a model of normal activity for users, devices and services, then flags meaningful deviations, such as a login from an unusual place or a service account reading data it never touched. It is strongest against stolen credentials, where the attacker looks legitimate except for behavior.
How does it differ from signature detection?
Signature detection matches known bad things: a file hash, a malicious address, a known exploit pattern. Behavioral analytics asks whether this activity is unusual for this actor. That helps where there is nothing to match, because the attacker is using valid credentials and normal tools.
NIST SP 800-207 on zero trust architecture illustrates the idea in access decisions. Its policy engine can weigh attributes including previously observed behavior, and its description of behavioral attributes includes automated subject analytics, device analytics and measured deviations from observed usage patterns. It notes that a system keeping some history may be more likely to detect an attacker using subverted credentials in a pattern atypical for that subject, and that deviations could trigger additional authentication checks or denials.
What does it look at?
Common inputs are authentication logs, access to files and databases, network flows, endpoint process activity and cloud API calls. A model summarizes each entity's usual hours, locations, peers, volumes and resources. NIST SP 800-215 describes cloud access security brokers detecting anomalies in users' cloud access behavior through user and entity behavior analytics, and using it to find account hijacking and insider threats.
MITRE ATT&CK shows the same approach on the endpoint. Its detection strategies for keylogging and for password cracking are behavioral: a non-UI service process calling keyboard hook functions, or hash cracking tools run after access to password files, combined with high CPU use.
What can it detect well?
- A valid account used at an odd hour from a new country, followed by bulk downloads.
- A service account that suddenly lists every storage container.
- A user who normally touches a few files opening thousands in minutes.
- Authentication patterns across many accounts that look like spraying.
- Session tokens used from two distant places close together in time. ATT&CK suggests monitoring for impossible travel and anomalous behavior as a way to spot stolen session cookies.
Where does it struggle?
Cold start. A new user or service has no baseline, so there is little to compare.
Legitimate change. A promotion, a new project or quarter end changes behavior, and the model flags honest work.
Slow attackers. An adversary who stays inside normal volumes and hours may never cross a threshold.
Alert fatigue. A score without context becomes noise. Analysts need to see what changed and why it matters.
Poisoned baselines. If the attacker is present while the model learns, their activity becomes normal.
A constructed example
An accounts payable clerk normally opens invoices between 9 and 5 from the office. At 2 a.m. the account signs in from another country, reads the vendor bank details table, then creates a mail forwarding rule. Each step alone could be explained. Together, against the clerk's baseline, they are rare. The system raises one case containing all three events, the analyst confirms with the clerk by phone, and the account is reset.
How to check or apply this
- Decide which identities and data are worth modeling first, such as admins and finance.
- Make sure the logs that feed the model are complete and time synchronized.
- Start in alert only mode and measure false positives for several weeks.
- Require each alert to explain what deviated and from what baseline.
- Pair detections with response steps: step up authentication, revoke sessions, notify the owner.
- Retune after known business changes.
- Combine with signature based and policy controls, not instead of them.
Quick check
Is behavioral analytics the same as machine learning?
Not necessarily. Some systems use simple statistics and rules about normal ranges. Others use machine learning. What matters is that detection is based on deviation from a baseline.
Can it replace MFA?
No. MFA prevents many account takeovers outright. Behavioral analytics helps catch the ones that get through.
Sources
- NIST SP 800-207, Zero Trust Architecture
- NIST SP 800-215, Guide to a Secure Enterprise Network
- MITRE ATT&CK T1056.001, Keylogging
- MITRE ATT&CK T1539, Steal Web Session Cookie
- MITRE ATT&CK T1110.002, Password Cracking
Last reviewed: 18 October 2026.
