Suspicious activity is behavior that deviates from expected patterns and could indicate misuse, tampering, or a security compromise. The term describes a warning sign, not proof that an attack occurred. For example, an alert from a password manager may justify investigation even when the available information does not establish unauthorized access or data exposure.
Security teams look for suspicious activity in logs and system telemetry, such as unusual sign-ins, unexpected changes to accounts or data, or access from unfamiliar locations. They verify alerts against context, contain credible threats, and preserve evidence for investigation. Users may also take prudent precautions, such as reviewing and changing important passwords after a warning involving a credential vault, without assuming a specific cause before it is confirmed.