Profiling

A profile is a structured summary built from data about a subject: static attributes, dynamic patterns, and inferred characteristics. Profiling begins when that data is analyzed to evaluate, categorize, or predict something about the subject, not merely when it is recorded.

The term covers very different domains, with different connotations:

• Marketing and advertising: profiles of interests and purchase intent, built from browsing and transaction data to target content and offers.
• Law enforcement and intelligence: suspect profiles built from records and communication metadata, where discrimination concerns are most acute.
• Information security: behavioral profiles of users, accounts, and devices, used to detect anomalies and insider risk. This article focuses on this area.

In security tools, a behavioral profile is built in repeating stages. The checks along the way look for familiar insider threat indicators.

1. 1

   Data collection

   Endpoint and application activity: app use, file operations, web and messaging traffic, and device connections.

2. 2

   Baseline

   A learning period defines what is normal for the subject: usual applications, data sources, working hours, and transfer volumes.

3. 3

   Indicator evaluation

   New events are compared with the baseline and with indicators of risky behavior, such as policy violations, unusual destinations, or abnormal volumes.

4. 4

   Scoring

   Matches and deviations are weighted into a risk score that updates as new activity arrives.

5. 5

   Human review

   An analyst examines the underlying events first. Profiles and scores serve as inputs to that review.

Security profiling is deliberately narrower. Its subject is behavior on corporate systems, and its output is a risk assessment, not a judgment about a person.

Its main value is focus. Insider risk programs concentrate attention where the profile shows elevated risk, such as a spike in data copying during a notice period or access patterns that suggest a compromised account.

Adjacent practices formalize this. User activity monitoring (UAM) supplies the raw events, and user and entity behavior analytics (UEBA) applies statistical models to surface anomalies.

In the Anexet Activity module, each monitored user has a card, and risk categories turn policy events into incidents with a risk level. The dashboard shows how incidents spread across categories, so an analyst can start from the pattern and then open the events behind it.

1 / 2

• 
• 

The GDPR defines profiling in Article 4(4) as automated processing of personal data to evaluate personal aspects of a natural person. That covers analyzing or predicting work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements. Behavioral risk scoring built on employee monitoring data falls within this definition.

Three obligations matter in practice. Profiling relies on legitimate interest, balanced against the impact on employees. Employees must be told that profiling takes place and about the general logic behind risk scores. Automated decisions with legal or similarly significant effects cannot rest solely on automated processing (Article 22) and need human-intervention safeguards.

Systematic employee monitoring also triggers a data protection impact assessment before deployment.

A profile that infers personality, political or religious views, health, or union membership is not a security control. Processing such special categories is restricted under the GDPR.

The difference between a legitimate security profile and a discriminatory one is not the algorithm. It lies in what the profile measures, how accurate it is, and who decides:

Most profiling failures are design failures. The programs that work sit inside a wider insider risk management process, and their limits are easier to set before the first score appears. The practical checks are:

• Define the security question first, and collect only the data it needs.
• Give employees a plain description of how risk scores are built.
• Review high scores by hand, against the underlying events, before any action.
• Restrict profile access to named security roles and log every view.
• Re-test thresholds regularly, because weak indicators flag ordinary work.

Start with the question a profile must answer, such as which accounts are touched at unusual hours. A profile that answers one question with evidence is worth more than a score that ranks everyone.

Teams that want this in practice can start with insider threat detection and widen the scope only when a concrete question requires it.

Further reading: Profiling.