Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Are Using User and Entity Behavior Analytics
Transcript
- Lucas: So there's this concept in security that sounds almost too simple at first — what if you just watch what users and machines normally do, and then scream when something doesn't fit? That's the whole premise of User and Entity Behavior Analytics — UEBA for short — and it's quietly becoming one of the most impactful layers in how enterprises detect threats. Luna: It's basically the 'know thy normal' approach. But I feel like the promise has been around for a while — why is it actually working now? Lucas: Great question. The short answer is data volume and machine learning maturity. Ten years ago, if you tried to build a behavioral baseline for every user and device in a company with 50,000 endpoints, you would have drowned in storage costs and false positives. Today, platforms like CrowdStrike Falcon and Microsoft Sentinel ingest telemetry at cloud scale and apply models that adapt in near real time. Luna: And the key distinction from traditional signature-based detection — UEBA doesn't need to have seen the exact malware before. Lucas: Exactly. Signature-based tools catch known bad. UEBA catches weird. And weird often means something that got past the perimeter. Let me give you a concrete example. A financial services firm I spoke with had a junior analyst in accounting who normally logged in from 8 AM to 6 PM, from her desktop in the Chicago office, accessing maybe a dozen specific folders. One weekend, that same credential was used to log in from a residential IP in Eastern Europe at 2 AM, and within 30 minutes it started querying the HR database. Luna: That's a massive deviation from baseline. Lucas: Right. No malware signature fired. The VPN was corporate-authorized. But the UEBA engine scored that session as a 97 out of 100 on its risk scale, and the SOC analyst got an alert. It turned out the credential had been phished two days earlier. They contained it before any data left. Luna: And that alert wouldn't have been possible with a static rule — there's no rule that says 'accounting people never travel to Eastern Europe.' The model had to learn her specific pattern. Lucas: Exactly. And that's why UEBA is such a natural fit for the zero-trust mindset. Zero trust says 'never trust, always verify.' UEBA adds a layer of 'and here's what trust should look like for this specific user at this specific time.' Luna: But it's not just users. The 'entity' part covers servers, IoT devices, service accounts — anything that generates behavior. Lucas: Good point. In fact, some of the most valuable UEBA detections involve machine to machine communication. Say a backup server that normally transfers data to a storage repository at 2 AM starts connecting to an external IP at 3 PM. That could be a compromised service account doing data exfiltration. A human might never notice that traffic, but a behavioral model flags it instantly. Luna: So how do you actually build these baselines? Is it pure machine learning, or is there human tuning involved? Lucas: It's a hybrid. Most commercial UEBA platforms start with an unsupervised learning phase — they ingest logs and network flows for a period, typically two to four weeks, and build statistical profiles. They look at attributes like login times, geolocation, accessed resources, data volume transferred, peer group comparisons. Then they apply supervised models on top, trained on known attack patterns — lateral movement techniques, privilege escalation sequences — to give those anomalies more context. Luna: And what about false positives? Because if you've got 10,000 employees and each one has a unique pattern, the model might flag a perfectly legitimate late-night code push from a developer who works best at midnight. Lucas: That's the perennial challenge. The leading platforms address it through peer-group analytics. The model doesn't just compare a user to their own history — it compares them to similar roles. So if a developer suddenly runs a SQL query that deletes a production table, but other developers in the same team do that during maintenance windows, the risk score is lower. The real art is setting the threshold so you catch the actual breaches without burning out your SOC. Luna: I've heard some CISOs say they initially configured UEBA too aggressively and got overwhelmed. Did that set adoption back? Lucas: It did for some early adopters. I remember a healthcare system that deployed a UEBA tool in 2019 and within a week had 1,200 alerts. Most were benign — doctors logging in from different hospitals, nurses accessing records for patients on different floors. They nearly scrapped the project. But after tuning for 30 days — excluding known clinical workflows, adjusting time windows — their alert volume dropped to about 15 per day, and three of those led to actual incident investigations. Luna: So the implementation curve is real, but the payoff is there. Lucas: Absolutely. And the market has responded. Gartner's latest market guide on UEBA shows that over 60 percent of large enterprises now have some form of behavior analytics in their security stack, either as a standalone tool or embedded in a broader SIEM or XDR platform. Luna: Which brings up the integration question. Are we seeing UEBA get absorbed into larger platforms, or is it still a standalone category? Lucas: Both, but the trend is definitely toward embedding. Microsoft has Sentinel's UEBA built in. CrowdStrike has their own behavioral models in Falcon. Splunk acquired Caspida years ago and baked it into their ES product. The standalone vendors like Exabeam and Securonix still have strong positions, especially in environments with very heterogeneous data sources, but the platform players are making the argument that integrated behavior analytics reduces operational overhead. Luna: Makes sense. One less tool to manage, one less console to check. But do you lose any capability by going embedded versus best of breed? Lucas: There's always a trade-off. Embedded UEBA tends to be optimized for the platform's own data schema. If you're all-in on Microsoft, Sentinel's UEBA works great. But if you have a mix of on-prem and cloud, legacy systems, custom apps, a standalone UEBA might offer deeper customization and more flexible data ingestion. It really depends on your environment. Luna: And the threat landscape is evolving too. Attackers are now aware of UEBA and are trying to fly under the radar — mimicking normal behavior slowly over time. Lucas: That's the cat and mouse game. Attackers will try to 'live off the land' — use legitimate tools, avoid obvious anomalies. Some advanced persistent threat groups have been known to study an organization's normal behavior for weeks before striking. But even then, the beauty of UEBA is that it doesn't just look at individual events; it looks at sequences. A series of small deviations over a month might be scored as low risk individually, but when correlated, they form a pattern that the model flags. Luna: So it's about the story the events tell, not just the individual dots. Lucas: Exactly. And that's where UEBA connects to the broader shift toward ai driven security operations. The SOC of the future isn't just going to be humans staring at dashboards — it's going to be humans guided by models that have learned what's normal for every single entity in the organization. Luna: Speaking of the future — what's the next frontier for UEBA? More real-time? More predictive? Lucas: Both. We're already seeing vendors move from detecting anomalies to predicting them — using temporal models to forecast when a user's behavior might go off baseline before it happens. There's also work on combining UEBA with external threat intelligence. So if a user's credential appears in a dark web dump, the model can preemptively increase scrutiny on that account. And I think we'll see more integration with identity governance — automatically revoking access when the risk score crosses a threshold. Luna: That's powerful. But it also raises the bar for accuracy. If you auto-revoke access based on a false positive, you've just locked out a legitimate user. Lucas: Right, which is why most organizations start with 'alert and investigate' before moving to 'automated response.' But the technology is getting more precise. The key is continuous tuning — and that requires a security team that understands both the data and the business context. Luna: It's interesting. If these conversations are useful for what you're building or running, a couple of dollars a month is genuinely what keeps these going. Buy me a coffee dot com slash fexingo, if you've gotten something out of them. Lucas: Yeah, it really does make a difference. Someone said to me recently that what we do here is like a free weekly consultancy for people in the trenches. And that's exactly the goal. Luna: Alright, back to UEBA. One thing I want to circle back on — you mentioned peer-group analytics. How granular can that get? Could you group by department, by seniority, by location? Lucas: Absolutely. The best implementations let you define peer groups dynamically based on multiple attributes. So a remote senior engineer in the Bangalore office might be compared to other remote senior engineers in Bangalore, not to the entire engineering org. That level of granularity reduces false positives significantly. Luna: And I imagine HR systems integration is key there — you need to know who's a senior engineer versus a junior one. Lucas: That's the hard part. Many organizations struggle with data quality. If your identity management system is outdated or incomplete, the peer groups will be noisy. But when it's done right, it's incredibly effective. I've seen a case where a finance manager who normally accessed 50 folders suddenly accessed 200 — UEBA flagged it as anomalous even though no single folder was unusual. Turned out it was an insider preparing to exfiltrate data. Luna: So it catches the silent insider threat that traditional tools miss. Lucas: Exactly. And that's why, despite the tuning effort, I think every enterprise SOC should be investing in UEBA capability. It's not a silver bullet, but it closes a gap that signature-based tools and basic SIEM correlation leave wide open. Luna: One more question — for a small company with 100 employees, is UEBA worth it? Or is it overkill? Lucas: It depends on their risk profile. If they handle sensitive data — healthcare, financial, intellectual property — then absolutely. Many cloud-based security platforms now include basic UEBA at no extra cost. Microsoft 365 Defender has user behavior analytics built in for every license. So small companies are already getting it, often without realizing it. Luna: That's a good point. So it's less about whether to adopt and more about whether to tune it and pay attention to its output. Lucas: Exactly. The technology is mature enough that the question isn't 'should I use UEBA?' it's 'how do I operationalize it effectively?' And that's where we'll see the biggest gains in the next couple of years.