Signature-based endpoint protection only catches malware it has already met. That makes it great for addressing known threats, but suboptimal against new threats. Google’s Threat Intelligence Group tracked 90 zero-day vulnerabilities exploited in the wild in 2025, and for the first time, close to half targeted enterprise technology rather than consumer devices.
Increasingly, technology companies are moving away from signature-based detection in favor of the more nuanced behavioral methods. This shift makes it possible for endpoint detection tools to flag suspicious behavior from previously unseen threats.
This is made possible through behavioral analytics: a method of monitoring an environment to understand normal behavior, making it easier to flag anomalous, suspicious, or risky events.
What Is Behavioral Analytics?
There are many activities that would be perfectly legitimate for one user to do, but highly suspicious for another to do. A single rule preventing or permitting this activity in all circumstances can be overly restrictive, or unnecessarily lenient.
For example, it is perfectly legitimate for someone in the finance team to authorize a payment to a contractor. This same activity, when carried out by a receptionist is highly suspicious. You can set up a simple identity policy that ensures that the right user can carry out actions related to their job.
Behavioral analytics take this one step further.
Behavioral analytics will flag if that finance team member is paying the right account, or if there are any indications that their account has been compromised. This is achieved by focusing in granular detail on how an employee normally operates. This is used to create a baseline, with any behavior that is considered not normal being flagged.
Let’s return to our previous example. Our finance employee may be authorized to pay contractors, and they usually complete this task from their office computer in Santa Fe on a Monday morning. If the system detects this user making payments at a different time of the week, that might indicate something else is going on. While this might not be malicious, it indicates that it’s not normal. When combined with other contextual indicators, such as the wrong location and device, we might deem that the activity is suspicious. Wrong location, wrong device, wrong time, but correct user login details are still suspicious. It could be that the user’s account details have been leaked.
Behavioral analysis builds a baseline picture of how an employee normally operates, who they interact with, and the areas they usually access, to generate a unique profile of this user. Any subsequent activity is compared to the expected activity, flagging anything that is unexpected.
It’s important that the baseline is continually but incrementally updated. Overtime, a user may find more efficient ways of completing tasks or their job requirements themselves may change. If the baseline updated too readily, it would defeat the point of there being a baseline. Equally, if the baseline never updated, it would increase friction as workloads change and evolve over time.
This is behavioral analytics in users, now we’ll look at this same philosophy when applied to malware and zero-days.
How This Works To Detect Malware And Zero Day Threats
Matching known threats to those that are affecting your environment is a great way of blocking the vast majority of threats. It does not, however, help you in fighting against new and emerging threats.
Attackers are evolving malware at a faster rate than ever before, meaning that signature-based detection is no longer sufficient. All it takes is for an attacker to make one small change to malware, resulting in it being deemed “unknown” and unaffected by these legacy systems.
Rather than checking if a signature has been flagged as malicious before, behavioral based analytics checks if the file behaves in a normal, expected way.
In practice, this involves building a baseline, using telemetry from endpoints, networks, applications, and identity systems. Once this is done, the system knows what normal is, with the ability to look into granular detail for each user, device, and task. This will include details like typical login times, common file access patterns, standard process behavior, and usual outbound connections.
Any time that there is a deviation from this expected behavior, a warning can be triggered. Live activity is compared with the baseline. The activity will be scored and prioritized in terms of how risky it is, as well as the severity and context of the behavior. Dependent on preset configurations, the activity may be blocked and passed onto your security team. They can then investigate the activity and assess if there is any justification for it.
We can consider how this plays out with ransomware. While the ransomware itself may be brand new, all ransomware follows the same general pattern. Existing files are encrypted and duplicate copies are deleted. Anytime this happens, you can be pretty sure that something sinister is happening, even if you have never seen that version of the ransomware before.
Zero-Day Threats
Signature-based detection and zero-day threats are diametrically opposed to one another. One is designed to identify things that have been seen before, the other is used to describe things that have never been seen before.
Behavioral analytics addresses this problem by focusing on how the exploit behaves, rather than if it’s known or unknown. Behavioral systems will monitor this activity, checking for behavior like credential theft, privilege escalation, lateral movement, command-and-control communication, or other unexpected behavior.
In essence, behavioral analytics is able to futureproof your defenses by responding to what is actually happening, rather than relying on a library of threats that is only as good as its latest update.
Behavioral Analysis’ Impact On AI-Generated And Polymorphic Malware
LLMs and code-generation tools are now widely available through consumer platforms. These tools can be used to generate new code or alter existing ones. Even a small change to code will result in it appearing to be structurally different, resulting in a different hash. This is enough for it to slip past signature defenses, despite the threat itself being almost identical.
Security researchers have documented PoC tools, such as BlackMamba, using AI to regenerate its own code after each execution. This means that every single execution will be seen as the first instance of that malware, completely bypassing legacy tools. Behavioral based analysis, however, will assess the way your code works, rather than checking if it’s been seen before.
The Drawbacks
So far, this article has laid out the areas where behavioral analysis is able to deliver outcomes that signature-based detection would fail.
- Baseline Evolution – by definition, a baseline takes time to develop. It needs to monitor and assess behavior over a period of time, before making inferences and generalizations about what is normal for that user. Any threats landing whilst the baseline is still being detected will not experience the same level of scrutiny.
- False Positives – Just because an activity is unusual, it doesn’t mean that it’s malicious. It could be a software update, a one-off business trip or an outreach reply off the back of a chance meeting. These are perfectly legitimate events but may be seen by as a machine as unusual and therefore risky.
- Living-off-the-land – Attackers know that these detection systems exist, so they will remain hidden by behaving in line with expectations and norms. This includes using trusted binaries to download payloads and using legitimate IAM tools to escalate their privilege and traverse a network.
Behavioral analysis can be highly effective. However, it’s important to remember that it cannot solve every problem.
Questions You Should Be Asking
With the widespread adoption of generative AI, the continuous battle between attackers and defenders has only increased in pace. Each endpoint security vendor has their own preferred method of identifying and addressing malware risks.
While there is lots to be gained through using behavioral based detection, it is not a fool proof solution. When looking to adopt a platform in your own environment, take the time to understand how each platform works, and if that’s going to be compatible with your environment, risk tolerance, and vulnerabilities.
We would recommend asking the following questions when you look to adopt a new solution:
- How long does baselining take before detection reaches full strength?
- Does behavioral coverage extend across endpoint, network, and identity telemetry, or only file activity?
- What does the false positive rate look like in a live environment, and what tuning does your team need to do to keep it manageable?
- And critically, how does the platform correlate behavioral alerts with other signals?
We’ve compiled a shortlist of the top Endpoint Security Solutions for Business Platforms.
