What this tells you
Whether the user’s email timing patterns — after-hours activity or reply speed — are unusually different from their own recent baseline.
What this can’t tell you
It does not directly indicate compromise, insider threat, or unsafe decision-making. Timing anomalies have many legitimate explanations.
How we describe it
Shows whether recent email timing patterns, such as out-of-hours activity or reply speed, differ unusually from the user’s normal recent pattern.