Process deviation is a departure from expected operating conditions or tolerances. In cyber security, the term is useful because many attacks first appear as a process that no longer behaves normally: a service consumes unusual CPU, a device sends traffic at odd times, a control loop changes state too often, or an application starts making unexpected system calls. The deviation may be small, but it can signal tampering, malware execution, misconfiguration, or an unstable environment.
Security teams look for process deviations by comparing live behavior with a baseline. That helps detect compromise in endpoints, servers, and industrial systems where “normal” is usually predictable. Attackers try to hide inside normal operations, so defenders focus on changes in timing, frequency, parameters, and dependencies. The challenge is distinguishing true risk from harmless variation; too narrow a tolerance creates noise, while too wide a tolerance lets attacks blend in.