The AI builds a profile of normal user behavior over time—such as login locations, email activity, and link-sharing habits. It flags deviations from this baseline, allowing IT to intervene before damage occurs.