Steve Jones wrote:
We, and the businesses that employ us, should be incorporating analytics into our defenses to detect abnormal actions ...
Which seems to be what products from cyber security vendors like Aorato do.
[Disclaimer: I'm not associated with Aorato in any way. I did try getting our data security officer interested in Aorato's software, but he just sniffed and went about his business. Maybe he'll pay more attention when some big data breach happens here.]