Composition effects occur when a statistical result changes because the mix of people, jobs, assets, or events has changed, not because the underlying behavior has changed in the same way. In labor data, a wage increase can reflect more senior applicants, different job titles, or a shift in who is being hired. The same idea applies in cyber security: a metric can move simply because the monitored environment is no longer the same.
This matters because defenders often compare averages, rates, and trends over time. If an organization adds more high-risk cloud workloads, more remote users, or more junior analysts, incident counts, detection times, and false-positive rates can all shift for compositional reasons. Attackers can exploit the confusion by changing tactics, target groups, or delivery channels, making their activity look different in reports. Good analysis separates true performance change from changes in the underlying mix by slicing data by host type, user group, alert class, or seniority band.