Cohort analysis is the practice of grouping users, devices, or events that share a common starting point or behavior and then comparing how those groups change over time. In cyber security, a cohort might be accounts created in the same week, endpoints patched on the same day, or users exposed to the same phishing training.
This method matters because averages can hide risk. Security teams use cohort analysis to see whether a control really worked: did one patch cohort have fewer infections, did a new MFA rollout reduce account takeovers, or did training lower click rates for one user group? Attackers can also use similar segmentation to target people with shared traits or exposure patterns. By tracking outcomes over time, cohort analysis helps separate short-term noise from real defensive gains or attack impact.