Anomaly monitoring is the practice of identifying activity that differs from an expected baseline and may signal abuse, compromise, or misuse. Systems can monitor events such as sign-ins, network connections, data access, and changes to user accounts, using rules or statistical and machine-learning methods to flag unusual patterns.
In cybersecurity, anomalies can reveal suspicious behavior that known threat signatures miss—for example, an account accessing unfamiliar systems or transferring an unusual volume of data. A flagged event is not proof of an attack: legitimate changes in work patterns can also look unusual, so analysts investigate alerts in context. Anomaly monitoring works best alongside controls such as multifactor authentication, least privilege, and clear approval processes.