When communication rhythm reveals risk.
OpenEFA® Signals Series | March 25, 2026
Every sender has a rhythm. How often they write, when they write, how many messages they send in a given window — these patterns form a behavioral fingerprint that is remarkably consistent over time. When that rhythm breaks, something has changed. And that change deserves scrutiny.
Volume and timing anomalies are among the most reliable early indicators of account compromise, automated abuse, and social engineering campaigns. They are also among the hardest signals for attackers to fake, because replicating a human's natural communication cadence requires knowledge that attackers rarely possess.
Humans are creatures of habit, and email behavior is no exception. Over weeks and months, patterns emerge:
These patterns are not rules — they are baselines. They describe what is normal for a specific sender-recipient relationship, and they provide the context needed to recognize when something is not normal.
When a sender's timing pattern shifts, the cause is usually one of a few categories:
An attacker who gains access to a legitimate mailbox rarely sends messages at the same times as the account's real owner. If a U.S.-based employee's account suddenly begins sending messages at 3:00 AM Eastern, that timing alone is a signal. The attacker may be operating from a different time zone, or they may be automating message delivery on a schedule that doesn't match the account owner's habits.
Automated systems send email differently than humans. Messages arrive at precise intervals — exactly every 60 seconds, or exactly on the hour. Humans don't operate with that kind of mechanical precision. Even subtle regularity in send times can indicate that messages are being generated by a script rather than typed by a person.
After a successful credential compromise, attackers often move quickly. A mailbox that normally sends five messages a day suddenly sends fifty in an hour. The volume spike alone is informative, but combined with timing — the messages cluster in a short burst rather than spreading across the day — the signal becomes much stronger.
Sophisticated BEC attackers sometimes test compromised accounts by sending a small number of innocuous messages at unusual times, gauging whether monitoring systems will flag the activity. If those test messages go unnoticed, the attacker proceeds with the real attack. Detecting the timing anomaly in the test phase prevents the attack from ever reaching the payload phase.
Volume changes carry their own category of risk signals:
A sender who normally sends three messages per week suddenly sends thirty in a single day. This can indicate a compromised account being used for spam distribution, phishing campaigns launched from a trusted domain, or automated exfiltration of data via outbound email.
Some attackers are more patient. They slowly increase volume over days or weeks, hoping the gradual change won't trigger alerts. A sender who averaged five messages per week now averages fifteen. Each individual day looks borderline normal, but the trend is clear when viewed over time.
A sender who has been consistently active goes quiet for an extended period, then suddenly resumes with different patterns. The gap may represent the period during which the account was compromised and the attacker was observing. The resumed activity is the attacker, not the original user.
A sender begins directing an unusual volume of messages to a single recipient or a small group, rather than their normal distribution pattern. This concentration can indicate targeted social engineering, where the attacker is focusing effort on a specific high-value target within the organization.
OpenEFA constructs per-sender behavioral profiles that track communication patterns across multiple dimensions:
These baselines are built over time and continuously refined. They are specific to each sender-recipient pair, which means OpenEFA doesn't just know that a sender is active at unusual times — it knows that this sender is active at unusual times for this particular relationship.
Attackers can forge headers. They can spoof display names. They can craft convincing message content. But replicating a sender's natural communication rhythm is extraordinarily difficult.
To fake timing convincingly, an attacker would need to know:
This information is not available in stolen credentials. It's not in a breached database. It's not in a LinkedIn profile. It exists only in the email flow itself — which is exactly where OpenEFA observes it.
Even if an attacker attempted to match the sender's schedule, the precision required is extreme. Sending a message at 9:15 AM when the real sender typically sends between 9:00 and 9:30 might seem close enough, but OpenEFA tracks patterns at a granular level. The combination of timing, frequency, and cadence creates a behavioral signature that is far more difficult to replicate than any single data point.
Consider this situation:
Sender: A vendor contact who has been communicating with your procurement team for eight months.
Established pattern: 2–4 messages per week, sent between 9:00 AM and 5:30 PM GMT, typically on weekdays, with an average response time of 4–6 hours.
Anomaly detected: On a Saturday at 11:47 PM GMT, the vendor's address sends three messages in rapid succession (within 8 minutes) to three different recipients in your finance department.
Each message contains a slightly different version of an updated payment form and a request to process before Monday morning.
Every individual message passes authentication. The content is professional. The attachments are clean PDFs. A traditional gateway sees three legitimate messages from a known sender.
But OpenEFA detects multiple deviations from the sender's baseline:
No single anomaly is proof of compromise. Together, they form a clear pattern of deviation that warrants elevated scrutiny — and in this case, prevents a fraudulent payment from being processed before anyone arrives on Monday morning.
Volume and timing anomalies rarely operate in isolation. Their power increases dramatically when combined with other OpenEFA signals:
This compositional approach is central to the OpenEFA Signals framework. Individual signals provide suspicion. Combined signals provide confidence.
Volume and Timing Anomaly detection is part of the OpenEFA Signals framework — a set of behavioral and contextual patterns that reveal risk before it becomes an incident.
The core principle: behavior is identity. When you strip away headers, authentication tokens, and display names, what remains is how a sender actually communicates — their rhythm, their cadence, their patterns. These behavioral signatures are deeply personal and extremely difficult to counterfeit.
Traditional security asks: "Is this message from who it claims to be?"
OpenEFA asks: "Is this message consistent with how this sender actually behaves?"
That distinction is what separates authentication from understanding — and understanding is what catches the attacks that authentication cannot.