The next attacker in your environment probably won't look like an attacker. With AI in the mix, they can sign in with stolen credentials and use the same tools your IT team uses every day. Nothing about that activity matches a known-bad file or a known-bad rule.
That is the problem Endpoint Drift is built to solve. It learns what normal looks like for each endpoint, then shows you which ones have started behaving differently, and why.
The attacker now looks like your admin
The numbers show how much the picture has changed. According to the IBM Cost of a Data Breach Report 2026, one in four malicious breaches is now AI-enabled, up 56% in a year. Each one costs about $6M, roughly $1M more than the average breach. Mandiant's M-Trends 2026 puts the median time from initial access to hand-off to the next attacker at 22 seconds. In 2022 it was over 8 hours.
Defenders are not moving at that speed. IBM reports a global mean time to identify and contain a breach of 247 days, and an average breach cost of $4.99M. Attackers move in seconds while detection still takes months.
Why known-bad detection isn't enough
Signatures, IOCs, and rules answer one question: does this match something we already know is bad? That is valuable, but it can't answer "what changed?" Three gaps explain why.
- Signatures only see the known. An attacker using valid credentials and admin tools doesn't match any rule someone has already written.
- Normal is different on every machine. What's routine for a finance laptop is strange for a database server. Comparing a machine to a fleet average hides the one machine that changed.
- Hunters start from a blank fleet. With thousands of endpoints and a pile of alerts, the hardest question is the simplest one: which machines should we look at first?
What Endpoint Drift does
Drift compares each endpoint only to itself. It builds a baseline from that machine's own history, checks current behavior against it, and ranks endpoints by how far they have moved from normal. Each finding names the behaviors that changed, so your team knows where to look.
It works in five steps: observe how the endpoint behaves, baseline its normal, compare today against that normal, rank who changed the most, and explain what moved and why. There are no rules to write to get started.
Why Tanium can do this
Knowing what normal looks like takes a lot of history from every machine. Tanium already runs on every endpoint, so each machine builds its own baseline from its own activity, right where it happens.
What Drift notices
Drift watches many behaviors on each endpoint. The main categories are:
- Programs: new, unsigned, or unusual programs, or programs running from temporary folders.
- Files and settings: changes in startup or password locations, or a sudden burst of archives being created.
- Network connections: a machine reaching out to far more places than usual, or to remote-access and file-sharing ports it rarely uses.
- Sign-ins and access: a type of sign-in the machine has never seen, like remote desktop, or a burst of failed sign-ins.
- Web lookups: far more DNS lookups than normal.
- Admin tools used oddly: command shells, "who am I" style lookups, and download tools like curl or wget showing up more than usual.
These are categories with examples, not a complete list. And because every comparison is against that machine's own history, the same activity can be routine on one endpoint and a finding on another.
What your team sees
Drift lives in Tanium Atlas. Analysts open the Behavioral Drift Investigation page from the template gallery or ask Atlas about the drift leaderboard. Endpoints are ranked by drift score, along with what drove each score and a flag for machines in the middle of a planned deployment. From there you can click into any endpoint, see what moved, and ask Atlas follow-up questions in plain language.
When you review a finding, you'll likely want to decide which kind of change it is:
- Expected change: it lines up with a known rollout or operational change. Confirm and move on.
- Needs review: the change is real, but the cause isn't known yet. Gather context first.
- Investigate: the change is still unexplained or looks suspicious after review. Hand it to your investigation process.
What Drift is not
A finding is a starting point, not a verdict. Drift doesn't mean you've been compromised. It works alongside signatures and your existing detections. Known-bad detection tells you whether something matches a known threat. Drift tells you which machines are acting unlike themselves. Your security team, with Atlas, decides whether the change matters.
Normal business activity can cause drift too. Software rollouts and changes in how people work show up as explainable change, so teams can confirm and move on.
See it on your own endpoints
The best way to understand Drift is to watch it rank endpoints and explain what changed. Request a demo, or talk to an expert about how Drift fits your SOC.
When the attacker looks like your admin, the question to ask isn't "is this known bad?" It's "which machines stopped behaving normally?"
Sources: IBM Cost of a Data Breach Report 2026; Mandiant M-Trends 2026.