Five Access Patterns That Should Never Go Unnoticed

Anomaly detection sounds abstract until you name what it's actually catching. Most serious data incidents leave the same handful of fingerprints in the access record. Here are five that should never slip by unseen — and why each one matters.

1. The volume spike

A user who normally opens a few files a day suddenly downloads hundreds. Bulk collection is one of the clearest signals of an account preparing to exfiltrate data — whether it's a departing employee or a compromised login. Volume, relative to a user's own baseline, is one of the strongest early indicators there is.

2. Access at the wrong hour

Data doesn't usually need to be touched at 3 a.m. Activity far outside a user's normal working pattern — odd hours, unusual days — is worth a second look, especially against sensitive repositories.

3. First contact with a sensitive repository

A user reaching into a high-sensitivity store they have never accessed before is a classic sign of either lateral movement by an attacker or an account operating outside its role. Legitimate access has history. First contact doesn't.

4. Sensitive data heading outward

Files that carry a high risk score suddenly being shared externally, copied to personal locations, or moved toward exit points deserve immediate attention. The sensitivity of the data and the direction of its movement together tell the real story.

5. Behavior that breaks the user's own pattern

The most useful baseline is a person compared to themselves. When someone's activity diverges sharply from their established pattern — new systems, new file types, new rhythms — that deviation is often the earliest warning, well before any single action looks alarming on its own.

From pattern to proof

Capsule watches for exactly these signals in real time across all connected storage, and records every action in an immutable Audit Trail. So a flagged pattern isn't just a notification you have to chase — it comes with the full evidence of what happened, ready for investigation or for a regulator's question.

Anomalies aren't mysterious. They're recognizable — if something is watching for them.

Want to see which patterns surface in your data? Request a demo →.