Why Security Event Baselines Beat Raw Alert Counts

Raw alert counts look decisive until traffic doubles or a partner rotates certificates. Without a baseline, volume alone cannot tell you whether something is wrong or merely louder.

A useful security event baseline covers a fixed window—often two to four weeks—and separates release days, batch windows, and ordinary weekdays. It names units: failed logins per active session, privilege changes per admin cohort, anomalous API calls per tenant.

Baselines should also state what they cannot see. If client-side instrumentation is absent, say so. If a dependency is a black box, mark it. Honest gaps beat a polished chart that implies total coverage.

Teams in the UK who keep these baselines close to the people who respond recover faster: they argue less about whether a spike is “big” and more about whether it is unexpected.