A baseline can learn the attacker

Anomaly detection needs to know what normal looks like. Most tools work that out by watching your environment for a while and averaging.

Think about what that means if the attacker is already inside.

An actor who moves slowly gets included in the definition of normal. Their logons become part of the expected pattern for that account. Their transfer volumes lift the mean the tool later compares against. The more patient they are, the more thoroughly the baseline absorbs them, and the higher the bar becomes for detecting whatever they do next.

This is not hypothetical arithmetic. It is one reason that alerts phrased as unusual for this user tend to miss the quiet dwell period and catch only the noisy end, when somebody finally runs something loud.

Two things help. Know when each baseline was computed and over what window, so that a baseline built during an intrusion can be treated as contaminated and rebuilt afterwards. And keep some detections that do not learn at all. A rule that fires on a specific behaviour every time, however common it becomes, is immune to this failure, and it is the reason not to build everything on anomaly scoring.

Find out how your behavioural tooling learns and how far back its window reaches. Then ask what it would have concluded if the first two weeks of that window had contained an intruder.