At any given moment, employees might be logging into an application, opening shared files, downloading files and sharing data through a range of communication tools. This all represents data that UBA collects and sifts through based on predefined rules about what's considered "normal" behavior.
It would be impossible for a single IT admin or even a large team to assess what every user is doing in an organization, and in many cases, they could probably see a lot of routines and consistent activity. UBA becomes powerful because it spots anomalies, especially those related to security threats.
When a user suddenly starts downloading gigabytes of files instead of the normal 10 MB a day, for example, user behavior analytics could tell an organization that it is at risk of a data exfiltration attempt. If a user suddenly accesses a server they would normally never touch, UBA could help detect a compromised endpoint. Other possibilities include attempting to infect mission-critical systems with malware, or simply insider threats where employees tamper with (or steal data from) systems they have access to.
UBA accomplishes this through the use of artificial intelligence technologies such as machine learning. That means it can not only monitor more user behavior than a human but with greater accuracy.