Security analysis that evaluates patterns of user and system activity to detect suspicious behavior that may indicate compromised accounts or insider threats.