Behavior baselining is the process of learning what “normal” activity looks like for a user, device, account, or network, then comparing new activity against that baseline to find unusual changes. A baseline can include login times, geolocation, command patterns, request rates, file access, or how often an account performs certain tasks.
It matters because many attacks do not start with obvious malware or a single blocked action. Instead, intruders often act like legitimate users at first, then gradually change behavior to evade detection, move laterally, or automate abuse across accounts and sessions. Defenders use baselines in SIEM, UEBA, and fraud systems to flag anomalies such as impossible travel, abnormal bursts of requests, or unusual task repetition. In the context of AI-assisted abuse, baselining helps spot repeatable multi-step patterns that look ordinary one step at a time but become suspicious when viewed as a whole.