ks human behavior, there could be certain privacy concerns. Tracking what employees do during their workday is unpleasant, especially when talking about the systems some tech giants apply to track their employees' presence. However, the UBA concept does not suppose personal tracking - it records only the behavior that is valuable for cybersecurity analysis. Its conjunction with SIEM, EDR, XDR or any other cybersecurity solution may expand the range of recorded information. Still, it will likely never pay attention to what employee posts on Facebook from the workstation. The key points of application for UBA are network connections, removable drives, shared directories, and endpoints.
Why should companies use behavioral analytics?
As it was mentioned, UBA, as well as UEBA, is very effective at detecting the malicious behavior of any user or device in the network. That is likely the only practical and proactive way to mitigate or remove the insider threat. While malware-related threats are nailed by solutions like EDR or XDR, insider threats are pretty hard to deal with without a monitoring tool like the UBA. The combination of anti-malware software (in the form of EDR or regular anti-malware) and UBA/UEBA is a perfect way to have your corporation secured. However, it has not only advantages.
The key problem of any software combination is compatibility. Even though vendors ensure that their software has 100% compatibility with additional modules, problems may happen. Sometimes the promised compatibility may be reached only with the applications from the same vendor, and all third-party apps will integrate poorly if they can be integrated. The UEBA and EDR/XDR/SIEM may conflict with access rights, decisions on incidents, and notification policies. Additionally, unoptimized apps may lead to serious issues with hardware overload, which are just the other pain in the neck.
Another issue is the price of these combos. Having these apps separately may sometimes be pretty expensive, and opting for several things simultaneously may cost even more. The support (as a part of the SaaS form) of different programs will make the retention expensive enough to make it impossible to carry on by small companies. And overall, small organizations have no reason to use such a complex solution. UBA will have no application since when you have less than 100 employees (you do not have many unusual behaviors to track).