There are always signs. A sniffle here, a slight tingle in the back of your throat. You know you’ve been exposed. Maybe your young nieces and nephews just visited (glorified, adorable petri dishes), or you just survived a cross-country flight next to someone coughing like a 19th-century Victorian orphan.
Before you know it, you’re down for the count with a full-blown flu.
What happens next depends on how well your body’s defenses recognize the intruder. A flu vaccine feeds your immune system weakened fragments of a virus so it can store that profile in memory. When the real threat arrives, your body doesn’t panic—it recognizes the contextual signal, crafts targeted antibodies, and shuts it down.
As security leaders running operations across every industry vertical, we have to ask ourselves: How do we build that same high-accuracy memory for our networks? And what does it actually mean for a user to be “risky”?
It sounds like a simple question. In practice, it’s one of the most complex challenges in security operations. A user downloading 500 files isn’t inherently malicious. A user logging in at 2:00 AM isn’t automatically compromised. Context is everything.
The Two Dimensions of User Risk
In a User Behavioral Analytics (UBA) framework, risk isn’t a single binary switch. It exists across two distinct dimensions that must intersect before you trigger an alert:
- Behavioral Anomaly (The Technical Signal): This measures deviation from baseline. It tells you that a user’s behavior changed, but it can’t tell you if that change is malicious, accidental, or just a late-night rush project.
- Organizational Context (The Human Signal): This provides the business reality. It answers: “Given this person’s role, status, and current situation, should this anomaly actually keep us up at night?”
*An anomaly without context creates an avalanche of false positives. Context without an anomaly leads to pure speculation. The sweet spot—high-confidence, actionable detection—happens only where the two collide.
Technical Signals: Mapping the Behavioral Trail
The most meaningful behavioral indicators typically align with specific phases of the kill chain or insider threat lifecycle:
- Reconnaissance & Access Expansion (MITRE ATT&CK: Discovery, Credential Access): Early-stage indicators often look like curiosity. Look for first-time access to sensitive HR or financial repositories, sudden spikes in directory queries, or out-of-band privilege requests. A two-year employee suddenly mapping out administrative consoles they’ve never touched is a smoke signal.
- Data Collection & Staging (MITRE ATT&CK: Collection): Once target data is identified, users prepare it for transport. Watch for sharp spikes in daily file access volume, mass downloads from shared drives, creation of encrypted archives (.zip/.rar), or copying files to temporary local folders. The signature here is volume plus breadth.
- Exfiltration (MITRE ATT&CK: Exfiltration): The final stage, though our goal is always to catch the staging phase before data moves. Key metrics include unsanctioned transfers to personal cloud storage, unusually large email attachments, abnormal DNS tunneling volumes, or sudden DLP alerts tied to an anomalous user.
- Account Compromise vs. Insider Threat: Compromised account indicators (like impossible travel or success after a string of failed logins) usually present as sudden, discontinuous shifts in behavior. Insider threats, by contrast, tend to show a slow, deliberate escalation over weeks.
Amplifiers: Adding Human Context to the Math
A behavioral deviation doesn’t happen in a vacuum. Organizational context acts as an amplifier (or dampener) on technical risk scores:
| Contextual Factor | Why It Amplifies Risk | SOC Action |
| Impending Departure | Data theft statistically spikes in the weeks surrounding an employee’s last day. | Elevate sensitivity on minor anomalies (e.g., a 50% download increase becomes high priority). |
| Performance Management | Grievances can drive motivation-driven insider risk. | Monitor for access expansion into HR, legal, or administrative systems. |
| Layoffs / Restructuring | Group disruptions narrow the window of access before offboarding. | Apply temporary cohort-based baseline adjustments during transition windows. |
| Privileged Access | Impact scales with access level. A sysadmin anomaly carries far more blast radius. | Weight scoring heavily based on identity blast radius, not just anomaly size. |
| Recent Role Changes | Role changes create noise, but also grant new access boundaries users may probe. | Cross-reference new access against approved baseline updates vs. out-of-scope probing. |
The Mechanics of Dynamic Risk Scoring
Modern operations can’t rely on static threshold alerts. Aggregating user risk requires a dynamic model:
1. Two-Layer Aggregation
First, individual anomalies are scored by severity (e.g., an impossible travel event scores higher than a slightly elevated file count). Second, those scores aggregate over time across multiple dimensions. Three low-level anomalies occurring simultaneously across different vectors should produce a higher risk score than a single isolated spike.
2. Temporal Trajectory
Risk is a curve, not a point in time. A user whose score slowly creeps up over three weeks is exhibiting low-and-slow insider behavior designed to stay under single-event thresholds. Conversely, an overnight spike points toward account takeover. Detection engineering must alert on trajectory, not just ceiling breaches.
3. Peer Group Normalization
Always baseline an individual against their immediate peers. If a financial analyst’s download volume triples during end-of-quarter closing, but all of their departmental peers show the exact same trend, the risk score should automatically dampen. If that analyst is the only one pulling data at 3:00 AM, the score escalates.
Common Pitfalls in Risk Operations
- Overweighting Single-Vector Anomalies: Avoid triggering high-severity alerts on a single metric. Require multi-dimensional convergence before ringing the alarm.
- Static, Non-Decaying Scores: Risk scores must decay over time as anomalous behavior subsides. A user who had a busy week three months ago shouldn’t carry a permanently elevated risk profile.
- Treating Scores as Binary Triggers: Risk scores guide analyst focus; they don’t replace human logic. A high score caused by a known, legitimate business cycle should be cleared efficiently, while a moderate score paired with a resignation notice warrants an immediate look.
Executive Takeaway
Detecting user risk isn’t about setting arbitrary download caps or blocking late-night work. It’s about building an operational immune system—one that combines behavioral telemetry with real-world business context to spot the subtle signs of infection before a breach goes full-blown.
Keep your baselines dynamic, feed your models rich human context, and ensure your SOC is hunting trajectories rather than chasing static noise.
↑
Share