New Actor Burst Detection

When a new actor appears in the system, their initial activity level tells you something important. A new team member with a moderate first-week activity level is onboarding normally. A new actor with an extremely high first-week activity level — far above the norm for new accounts — may indicate account takeover, improper access provisioning, or a service account that has been given inappropriately broad access.

What you can conclude

• New actors flagged as bursts (significantly above the average debut activity level) warrant an access review — verify that the account was legitimately provisioned and that the activity level is appropriate.
• A normal-looking debut activity level, even for a new actor, is not a concern.
• Multiple burst actors appearing in the same short period may indicate a systematic access provisioning issue.

How this chart works

Horizontal bar chart showing actors who appeared for the first time in the period, ranked by their debut week activity level. Actors exceeding 2 standard deviations above the mean debut level are flagged in red.