Peer Grouping and Where It Fails

Individual baselines answer "is this unusual for this person". Peer comparison answers "is this unusual for people like this person". The second question catches things the first cannot — including a new employee behaving unlike every colleague, and an entire team's behaviour shifting because one member started something the others did not.

How groups are constructed

Attribute-based. Groups defined by organisational data: department, job title, location, manager, seniority. Simple, explainable, and dependent entirely on HR data being accurate, which it frequently is not.

Behaviour-based. Groups derived by clustering entities with similar activity patterns, regardless of what the org chart says. Frequently more accurate, because two people in different departments doing the same job behave alike. Harder to explain to an analyst or an employee, because the group has no name.

Hybrid. Attribute groups refined by behavioural similarity. Common in mature products.

Access-based. Groups defined by entitlement — everyone with access to the same systems. Underused and often the most operationally meaningful, because it corresponds to what someone could actually do.

What peer comparison adds

Cold start coverage. A new joiner has no individual baseline. They do have a peer group, and comparing them against it is the only detection available in their first weeks.

Organisational change detection. If everyone in a team starts using a new service, individual baselines all flag it as anomalous. Peer comparison correctly identifies it as normal for the group, which suppresses a large class of false positives around any rollout.

Outlier identification. A person whose behaviour is consistently unlike every colleague is worth understanding. Sometimes the explanation is benign — a specialist role, an unusual working pattern — and sometimes it is not.

Privilege comparison. Someone accessing systems no peer touches is a strong signal, and it does not require any deviation from their own history.

Where it fails

Small groups. In a team of four, everyone is an outlier. Statistical comparison needs a population, and below roughly ten to fifteen members the results are not meaningful. Products rarely tell you when a group is too small; they produce a number anyway.

Wrong groups. HR data that says a person is in Marketing when they have been embedded with Engineering for a year produces comparison against the wrong population. This is extremely common and largely invisible.

Heterogeneous groups. "Engineering" contains people whose work is entirely different. A group that is not behaviourally coherent has a wide baseline, and nothing deviates from it.

Group-wide compromise. If several members of a group are affected, the group's baseline absorbs the behaviour and none of them stand out.

Stale groups after reorganisation. Peer comparison silently breaks and continues producing scores.

The fairness problem

Peer comparison flags people who differ from their colleagues. That is the point, and it has a consequence worth stating plainly.

Someone with an atypical working pattern — caring responsibilities, a disability accommodation, a different time zone, a religious observance affecting their week — will differ from their peer group consistently, on features that have nothing to do with risk.

A system that scores them higher permanently, and an analyst who sees an elevated score every week, produces exactly the outcome that no one intended.

Practical checks:

Look at the distribution of elevated scores across the workforce. If the same individuals appear continuously, examine why before assuming it is behavioural.

Exclude features that are proxies for protected or personal circumstances where they do not carry detection value. Hour-of-day is the common example: it is genuinely useful for detecting compromise from another continent and genuinely discriminatory when applied to someone who works evenings for childcare reasons.

Make peer group membership visible to analysts, so that "this person is not comparable to this group" is a conclusion they can reach.

Making it work

Verify group data before deployment. Sample twenty people and check that their attributes are correct. The error rate will surprise you.

Set a minimum group size and suppress comparison below it rather than producing a meaningless score.

Refresh groups on organisational change, not on a fixed schedule.

Prefer access-based grouping for privileged populations, where entitlement is a better predictor of appropriate behaviour than department.

Verifying groups before you trust them

Peer comparison is only as good as the group definitions, and group definitions are built from data that is rarely audited.

Sample twenty people and check their attributes. Department, title, manager, location. The error rate in most organisations is higher than anyone expects, and every error produces comparison against the wrong population indefinitely.

Look at group sizes. Count how many groups fall below your minimum. If a large fraction of the workforce sits in groups of five, peer comparison is not available for most of your people and the product is producing numbers anyway.

Check behavioural coherence. For each group, look at the variance of key features within it. A group with enormous internal variance has a baseline wide enough that nothing deviates.

Find the people who match no group well. Specialists, dual-role staff, people on secondment. They will be permanent outliers, and identifying them in advance prevents a year of repeated investigation.

Common false positives

Team-wide change. A group adopting a new process generates deviation for whoever adopts it first.

Seasonal role differences. One member covering for an absent colleague temporarily behaves like a different role.

Newly formed teams, where the group has no established collective baseline.

Matrix reporting, where the org chart group and the working group differ.

Specialists in generalist groups — the only database administrator inside a broader engineering department will deviate on every feature, permanently and legitimately.

Blind spots and assumptions

That the org chart reflects reality. It reflects the last time someone updated it.

That similar roles imply similar behaviour. Two people with the same title can have entirely different work.

That the group is uncompromised. Peer comparison detects individuals who differ from the group, not groups that have collectively shifted.

That group membership is explainable. Behaviourally derived clusters frequently are not, and "the model grouped you with these people" is a difficult sentence in an investigation.