A security baseline is the recorded picture of normal activity in an environment—which accounts do what, when, from where, and at what volume—that anomaly detection measures against.
Key takeaways
- A baseline is your picture of normal. Detection measures deviation from it.
- Baselines are breaking because users now run AI agents that change the environment continuously.
- A malicious insider and an employee running an agent can produce identical telemetry. Telemetry alone often can’t tell them apart.
- Nobody has a reliable baseline for AI agent behavior yet, including us.
- You can still act today: inventory agents, make authorization records reachable, and shorten the loop between a new agent appearing and the SOC knowing.
For years, a security baseline was something you built once and tuned. Learn what normal looks like, flag what isn’t. That model assumed the environment changed slowly. It doesn’t anymore. This guide explains what a baseline is, why it’s breaking, and what you can do while the industry works out the rest.
What is a security baseline?
It’s the recorded picture of what normal activity looks like in an environment. Which accounts do what, when, from where, and at what volume. Detection tools measure deviation against it.
If the baseline is wrong or stale, anomaly detection produces noise. Analysts chase alerts that were normal all along, or miss ones that weren’t.
Why are security baselines breaking now?
Because the environment changes continuously. When users run AI agents, activity patterns shift faster than a baseline can settle. The picture never holds still.
The speed that matters is no longer the speed of containment. It’s the speed at which you can understand your own environment.
How do you tell a malicious insider from an employee running an agent?
Often you can’t, from telemetry alone. The signals can be identical: unusual volume, off-hours activity, access to systems the person doesn’t normally touch.
This used to be the hard EDR case: malicious insider versus benign activity. Now it’s malicious insider versus an inexperienced employee running an agent. Same logs. Different intent.
That’s the clearest example of why context has to reach the decision point. Who is this person? What were they assigned? What was approved? Telemetry doesn’t hold those answers. See what is context-driven security?
Is there a reliable baseline for AI agent behavior yet?
No. The industry doesn’t have one, and anyone who says otherwise hasn’t run agents long enough to know.
A static baseline can’t hold in an environment that changes daily. The practical response is continuous or automated purple teaming, which tests detections against realistic attacker and agent behavior on a rolling basis instead of freezing one picture of normal.
What should you do in the meantime?
Three things that don’t require a solved baseline are:
- Inventorying what agents are running, and who authorized them.
- Making the authorization record reachable from the investigation, so an analyst can answer “was this approved?” in seconds.
- Shortening the loop between a new agent appearing and the SOC knowing about it.
None of these fix baselining, but they do narrow the gap while the industry catches up.
Best practices
Want to improve your security baseline? Here’s where to start:
- Treat the baseline as continuous, not a one-time build.
- Know your agents. Keep a current list of who runs what, and who approved it.
- Connect identity and authorization to detection. Intent lives in context, not telemetry.
- Test detections on a rolling basis. Automated purple teaming beats a stale snapshot.
- Plan for baseline drift the way you plan for detection drift.
Expel’s take
We’ll say the unusual part out loud: this is a problem of today, not of the past. We see it across hundreds of customer environments, and the pattern is consistent. Insider and agent activity can look the same in the logs.
What we do know is where the answer has to come from. It’s not more telemetry. It’s context reaching the person making the call. Our SOC is human-led and AI-powered, and the human part matters most here, because intent is a judgment call. We’d rather tell you what isn’t solved than sell you a baseline that claims to be.
Frequently asked questions
What is a security baseline?
It’s the recorded picture of what normal activity looks like in an environment—which accounts do what, when, from where, and at what volume. Detection measures deviation against it. If the baseline is wrong or stale, anomaly detection produces noise.
Why are baselines breaking now?
Because the environment changes continuously. When users run AI agents, activity patterns shift faster than the baseline can settle. The speed that matters is no longer the speed of containment. It’s the speed at which you can understand your own environment.
How do I tell a malicious insider from an employee running an agent?
Often you can’t, from telemetry alone. The signals can be identical. This is the clearest example of why context—who the person is, what they were assigned, what was approved—has to reach the decision point.
Is there a reliable baseline for AI agent behavior yet?
No. The industry doesn’t have one. The practical response is continuous or automated purple teaming instead of a static baseline, because a static picture can’t hold in an environment that changes daily.
What should we do in the meantime?
Three things: inventory which agents are running and who authorized them, make the authorization record reachable from the investigation, and shorten the loop between a new agent appearing and the SOC knowing about it.