An aggregate pattern is a signal that only becomes clear when many individual events are analyzed together. A single action may look normal, but a series of small actions can reveal coordination, automation, or abuse. In cyber security, this matters because attackers often avoid obvious spikes and instead spread activity over time, across accounts, or across targets to stay below alert thresholds.
Defenders use aggregate patterns to detect behaviors such as repeated logins, slow-rate scraping, edit flooding, or staged probing. These detections rely on counting, correlating, and trending events so that a weak signal becomes visible at scale. In wiki abuse, for example, one edit may be harmless, but thousands of similar edits can expose a bot or agentic workflow. Aggregate pattern analysis helps security teams move from single-event review to behavior-based detection.