Low-and-slow activity is a pattern of small, repeated actions spread out over time so they do not stand out like a sudden burst. In cyber security, attackers use it to blend into normal traffic, whether they are probing accounts, scraping portal data, or testing access controls with routine-looking requests.
This matters because many defenses are tuned to catch spikes, not persistence. A campaign may use one IP, one account, or a narrow set of sessions to gather records quietly from SaaS portals and other web apps. Defenders look for subtle signs such as unusual request timing, repeated views of the same records, odd navigation paths, and access that does not match the user’s role or business need. Good portal telemetry and behavioral baselines help expose this kind of slow collection before it becomes a larger breach.