What is UEBA?
User and entity behavior analytics (UEBA) learns a baseline of normal activity for each user and device from identity, network and cloud logs, then scores deviations from it. For insider threats, that means it flags what's unusual for a person, not what's risky for the business.
It's a good idea aimed at the wrong problem. Insiders are who they say they are. They use access they were given, mostly doing things their job allows.
So UEBA answers "is this unusual?" Insider risk asks "does this matter?"
3 places UEBA loses the insider
The baseline learns the insider
Every UEBA model starts by profiling. Gartner named the catch in its 2018 Market Guide for UEBA: "A given user or peer group can be bad from the start of profiling, so that ongoing bad behavior will not be noted as anomalous to the baseline."
In Microsoft Sentinel's UEBA reference, "action uncommonly performed by user" looks back 10 days. Keep a behavior up for 2 weeks and it stops being uncommon.
An employee who starts collecting on day one, or spreads it thin, isn't an anomaly. They're the reference point.
The lesson: A baseline can't tell habit from intent. Given enough time, it certifies both.
Change looks like risk. Risk looks like routine.
The same Microsoft reference sets "first time user performed action" at 180 days. What counts as a first time: a new role, a reorg, an AI rollout, quarter-end, a business trip.
All of it is legitimate. All of it scores.
Now the moments that raise risk: a resignation, a performance plan, a competing offer, a layoff rumor. None of them appears in a sign-in log. Gartner's guide told buyers to consider HR data too. A model trained only on activity logs can't see it.
The lesson: The events that change someone's risk rarely change their logs. The events that change their logs rarely change their risk.
It sees the login, not the data
Per Microsoft's UEBA setup guide, Sentinel's UEBA reads sign-in, audit and cloud logs, plus supported firewall and proxy events.
That's enough to say a user signed in from a new device. It isn't enough to say the file was next year's pricing model, or that it went to a personal account an hour later.
In Microsoft's UEBA detection guide, the investigation priority score rates "how unusual a single event is" from 0 to 10. Unusual. Single. Event. Not what was taken, and not what came next.
The lesson: A risk score without the data is an opinion about the person, not a finding about the event.
UEBA vs insider risk management: the past vs the present
UEBA measures distance from the past. Insider risk is decided by context in the present.
Unusual is the wrong question for insider threats
UEBA isn't useless. It's good at spotting accounts that behave unlike their owners.
The mistake is making it the core of an insider program. The useful question isn't "is this unusual?" It's "is this normal for someone in this situation, touching this data?"
That's what context means: every action read against the person's role, peers, policy, the data involved and their own history.
Behavioral signal still matters. It shows up as a pattern that drifts over weeks, not as a single event scored against a 10-day window.
A 400-file download is routine for an analyst at quarter-end. It isn't routine for the same analyst 3 days after resigning. The log line is identical. Only the context changed.
Tuning won't close that gap. Gartner clients reported it takes "three to six months to get a UEBA initiative off the ground and tuned." Every reorg, new tool and role change restarts part of that clock.
The lesson: The same log line can be routine or risky. Only context tells them apart.
Test your UEBA against your last 3 insider cases
Pull your last 3 insider incidents or near misses: a leaver who took files, a contractor who overshared, a wrong attachment. For each, answer 3 questions:
Who told you first: UEBA, or a person? If it was HR, a manager or a customer, the baseline absorbed the behavior.
Did the alert name the data and where it went? If it named only a user and a score, you're watching logins, not data.
Did the alert know about the resignation, notice period or role change? If not, the moment that changed their risk was invisible to it.
Most programs fail question 1. In the ACFE's 2026 Report to the Nations, tips caught 43% of 2,402 occupational fraud cases first, and 55% of tips came from employees. Automated data monitoring caught 3%.
Then open your 10 highest-scoring UEBA alerts from the last 30 days. Count how many were a role change, a trip or a new tool.
The bar: if UEBA caught fewer than 2 of the 3 cases first, it isn't your insider detection. It's a login monitor.
UEBA tells you who's acting strange. Most insiders aren't.
FAQ
What is UEBA?
User and entity behavior analytics builds a baseline of normal activity for each user and device, then scores deviations from it. In tools like Microsoft Sentinel, it reads identity, network and cloud logs.
Can UEBA detect insider threats?
Partly. It's good at spotting accounts that behave unlike their owners. It struggles with insiders who stay inside their own pattern, who were risky from the start of profiling, or whose risk changes outside the logs, like a resignation.
What's the difference between UEBA and insider risk management?
UEBA asks whether an event is unusual for a user. Insider risk management asks whether it matters, using context such as role, employment status, device and the data involved, and reads the sequence of related events, not a single event.
