Metadata, not content: what behavioral baselines actually reveal

"Metadata only" can sound like a limitation — as if you're choosing to see less. It's worth being precise about what you actually give up and what you keep, because for access risk, the answer is surprising: you keep most of the signal and shed most of the liability.

This is a practical tour of the metadata that matters, how baselines turn it into signal, and — just as important — where metadata genuinely can't help.

The categories that carry signal

Access metadata isn't one thing; it's several streams that get more useful when combined.

1. Authentication and session events

Logins and sessions are the heartbeat of identity risk. Useful fields are almost entirely non-content: success and failure, source location and network, device class, time of day, and session duration. From these you get classics like impossible travel, sudden new-device access, brute-force patterns, and off-hours sessions that don't match a role's norm.

2. Access grants and entitlement changes

This is the most underused stream in most organizations. Every time a role, scope, group membership, or token is created or modified, that's an event. Tracked over time, it reveals privilege creep — the slow accumulation of access that no single change review would ever flag, because each grant looked reasonable in isolation.

3. Resource access patterns

Which systems an identity touches, how often, and in what sequence forms a behavioral fingerprint. You don't need to know what's in a record to notice that an account just started reaching repositories or datasets it has never touched in a year of history.

4. Volume and movement signals

Counts and sizes — number of records queried, files accessed, objects downloaded — are metadata, and they're where data-exfiltration risk shows up. A 10× spike in export volume is a signal regardless of what those exports contained.

How a baseline turns events into signal

Raw events aren't risk; deviation from normal is. A baseline is simply a model of what normal looks like, and the unit you baseline against matters enormously.

Secriiti baselines at the role and team level rather than building a secret per-person profile. A support engineer's normal differs from a data scientist's normal, and comparing each identity to its role's expected pattern catches the meaningful outliers — an account behaving unlike its peers — without constructing an individual surveillance dossier.

Good baselining accounts for a few realities:

• Seasonality. Quarter-end finance activity isn't an anomaly; a flat baseline would drown you in false positives.
• Role changes. When someone moves teams, their "normal" should move with them — and the transition itself is a risk window worth watching.
• Peer comparison. Sometimes the strongest signal is "this account looks nothing like the eleven others in its role."

Combining streams beats any single one

The real lift comes from correlation. A new-location login is mildly interesting. A new-location login followed by a dormant token waking up followed by an egress-volume spike is a story. None of those events required reading a single message; together they're a high-confidence signal worth a human's attention.

Content tells you what was said. Metadata tells you what was done. For access risk, what was done is usually the question.

The honest limits

A vendor that claims metadata catches everything is selling you something. It doesn't, and pretending otherwise is how trust gets lost. Here's where metadata-only detection is genuinely weaker:

• Intent inside authorized activity. If someone is allowed to access a record and does so within normal patterns, metadata won't reveal that they intended to misuse it. That's a true gap.
• Content-specific policy. Detecting a particular phrase, a specific document classification embedded in text, or regulated data by its contents requires content inspection. Metadata sees the envelope, not the letter.
• Brand-new patterns with no baseline. A behavior the organization has never exhibited has no "normal" to deviate from yet. Baselines need history.

The right framing isn't "metadata replaces everything." It's "metadata is the high-yield, low-liability core, and you add content inspection deliberately and narrowly where a specific risk justifies it" — not as the default lens for the entire company.

Why this is the better default

Start from metadata and you get a program that scales, that you can explain to the people it covers, and that doesn't turn your security tooling into the most sensitive database you own. Add content inspection as a scalpel, not a dragnet. For the large majority of access risk that actually causes incidents, the envelope is enough.

Keep reading: Joiner, mover, leaver: the access lifecycle where risk actually lives →