Per-user baselines: how much history, and what if it's poisoned?
Experiment designHardProblem. Salesforce's published insider-threat work profiles behavior per organization and per user from roughly three months of history, then scores the distance of each new event from that profile. Why three months, and what could go wrong with this design?
Before you reveal: say your answer out loud, as if you were in the real interview — get your reasoning across clearly first. There is no single correct answer: reading what the interviewer is really after and defending your own thinking is what makes an answer strong.