Operating context is the real-world environment in which a security or compliance control is used. It includes the business process, user behavior, transaction patterns, risk tolerance, regulatory requirements, and the technical systems around the control. In cyber security and AML, a control cannot be judged only by whether it works in a lab or passes a checklist; it has to work against the way the organization actually operates.
This matters because attackers often exploit mismatches between a control and its context. A rule that looks strong on paper may generate too many false positives, ignore normal exceptions, or miss subtle abuse hidden inside legitimate activity. Defenders use operating context to tune alert thresholds, interpret anomalies, and decide when human review is needed. For example, a transaction pattern may be routine for one customer segment but suspicious for another. Good security programs treat context as part of the defense, not as background noise.