Entity Analytics

Entity analytics is the behavioural analysis of every identity in an environment, human and non-human, to learn what normal activity looks like for each one and flag deviations that suggest compromise or misuse. An entity is any actor with an identity: an employee, a contractor, a service account, an API key, a workload, or an AI agent. NIST's glossary treats the underlying category as user and entity behavior analytics (UEBA).

Entity analytics is the broader successor to user and entity behaviour analytics (UEBA). The shift matters because in most environments non-human identities now outnumber human ones by a wide margin, and a model trained only on employee login patterns cannot reason about a service account that suddenly queries a new database or an AI agent invoking a tool it has never used. Where UEBA asked whether this user is behaving unusually, entity analytics asks the same of every principal and, critically, of the relationships between them.

In practice the capability appears inside ITDR platforms and identity security posture tooling rather than as a standalone product category. Evaluate it on three things: which entity types are actually modelled, whether relationships between entities are represented or only individual behaviour, and how the baseline handles legitimate change such as a deployment or a seasonal workload.

See also: ITDR, non-human identity, identity threat detection platforms