TL;DR SUMMARY: Baseline behaviour gives security teams a clearer picture of what normal looks like, helping them direct limited resources where they’re most useful. The right tooling can make continuous measurement far more practical.
There’s an old saying that you should measure twice and cut once. It’s good advice for carpentry, and surprisingly good advice for cyber security.
Before you cut a piece of wood, you measure it carefully because the cost of getting it wrong comes afterwards. Cyber security has a similar challenge. Organisations are constantly deciding where to put limited resources, which users need more support, which behaviours deserve attention and where a particular team may be carrying more risk than another, often with only a partial picture of what’s happening across the organisation.
The problem with trying to secure everything equally
There’s a reasonable argument that organisations simply don’t have enough time to baseline behaviour. Security teams are already dealing with alerts, incidents, vulnerabilities, compliance requirements and an ever-expanding list of things that need attention, so adding another exercise to the list can understandably feel difficult to justify.
In many cases, the constraint is closely tied to the resources available to turn activity into something useful. If understanding baseline behaviour means manually collecting data, comparing reports and repeatedly piecing together a picture of what normal looks like, it’s easy to see why the process gets pushed down the list.
That can leave security teams working with broad assumptions about behaviour, while having limited visibility into how those behaviours actually vary between individuals, teams and roles.
Measure twice, cut once
A baseline provides a reference point, giving security teams a clearer understanding of what typical behaviour looks like across an organisation, while also revealing where individual users, teams or patterns of activity differ from that norm.
Imagine being able to measure continuously rather than measuring only when there’s a particular concern. Instead of asking whether something looks unusual after an incident or during an annual review, a continually developing picture of normal behaviour provides context for understanding changes as they happen.
The value comes from being able to interpret activity in context. A user who appears unusually risky in isolation may look quite different when their behaviour is considered against their role, team and previous activity, while a team that appears broadly secure may reveal a recurring pattern that would be difficult to identify from individual events alone.
Baselining gives those observations somewhere to go, creating a reference point against which behaviour can be understood over time.
From broad assumptions to targeted resources
This becomes particularly useful for security teams working with finite resources. If the data shows that one group is encountering certain types of threats more frequently, or that particular behaviours are concentrated within a specific part of the organisation, resources can be directed accordingly.
Training, interventions and additional support can then be shaped around what people are actually doing, rather than what an organisation assumes they might be doing. Over time, that can move security away from distributing the same intervention everywhere and towards making more informed decisions about where effort is likely to have the greatest effect.
Good tooling can act as a force multiplier here. It can make the ongoing collection and interpretation of behavioural information considerably less labour-intensive, while giving security teams access to individual-level insight alongside broader organisational trends.
Redflags is one example of an approach built around that idea, giving organisations a way to establish behavioural baselines and continuously build a picture of how security behaviour is changing across individuals and teams.
The useful part is what that information enables. A baseline can help someone decide what deserves attention, where a resource should go, whether an intervention is appropriate and, eventually, whether that intervention has changed behaviour.
Baseline first, intervention second
There’s a temptation in cyber security to move quickly from identifying a potential problem to deploying a solution, particularly when security teams are under pressure to demonstrate action. A little more measurement can sometimes give that decision greater precision, helping organisations understand whether an issue is isolated or widespread, whether a behaviour is genuinely unusual, whether a particular team needs additional support and what has changed after an intervention.
That final point is especially useful because a baseline creates something against which improvement can be observed. Rather than relying entirely on completion rates, survey responses or the assumption that an intervention has worked, security teams can begin to see whether behaviour is actually moving in the intended direction.
The result is a more considered use of security resources. People can receive support where the evidence suggests it will be useful, security teams can develop a clearer understanding of changing behaviour and organisations can shape their security strategy around what is actually happening across their environment.
Measure twice, cut once.
In cyber security, perhaps the modern version is simpler still: keep measuring, so you know where to cut.
Key takeaways
- Know your normal. A behavioural baseline gives security teams a clearer view of what’s happening across the organisation.
- Let the data guide the effort. Individual and team-level patterns can help direct support towards the places where it’s most useful.
- Make measurement continuous. A moving picture of behaviour gives context that one-off assessments can’t provide.
- Give your security team more leverage. The right tooling can turn ongoing measurement into a practical force multiplier, helping limited resources go further.
