What Is Real User Monitoring?

RUM focuses on receiving real data and analytics from actual users, unlike other monitoring that uses automation to retrieve data. Testing production using code and bots is common in web application analysis to determine if it can handle a specific user load. Synthetic monitoring emulates user behaviours, but real user monitoring takes metrics from actual users in their browsers as they navigate throughout the website. By retrieving RUM metrics, organisations can get valid data on the way users experience the web application so that administrators can determine if performance is sufficient to handle the traffic.

To get real user data, RUM-enabled sites insert client-side JavaScript code on each page to collect browser information and user behaviour. As users click links, navigate to different pages, and interact with web page components, RUM code gathers information. Administrators, marketing people, and site owners can review these metrics in analytic dashboards and reports to understand the ways users interact with the site.

In marketing, RUM has several benefits. It can detect popular pages and the links commonly used to browse other products. It can link different products together for better upsell potential. If the site has a checkout and payment section, RUM identifies the point at which users typically abandon their shopping carts and the checkout process.

RUM is beneficial for marketing, but it can also help in cybersecurity and fraud detection. Many of the common attacks in the wild use scripts and bots to find website vulnerabilities. These bots usually don’t support JavaScript, so frequent scripted attacks can be detected using real user monitoring. It can also detect errors and identify sections of the site that do not attract visitors or provide a good user experience.

In cybersecurity, RUM can detect specific attacker actions. Mainly, it's employed to determine if a user’s account is under attack. When attackers steal credentials, they often use scripts to authenticate into user accounts. Normally, thousands of accounts matched with stolen credentials live in an attacker’s database from a phishing scam or downloaded files on darknet markets. Real user monitoring metrics can detect several failed authentication attempts on a user’s account. While this would not positively detect an attack, it can be combined with other suspicious behaviour to flag the account and stop attackers from further authentication attempts. If several user accounts are flagged, then administrators can be notified of a potential brute-force attack.

Load times can be detected using RUM methods. By determining the duration of time for a page to load, website administrators can identify if the webserver needs more resources or if additional infrastructure is necessary to speed up the site. Site speed is one of the metrics search engines use to determine ranking algorithms. Slow sites negatively affect user experience, leading to a higher bounce rate or abandoned shopping carts. RUM helps sites manage these issues before they impact revenue.

While RUM is mainly used in marketing, it can determine if the site is under attack from internal and external threats. Employees, vendors, and third-party individuals with access to the environment can be threats. Some threats are intentional, but threats can be from unintentional attacks such as stolen credentials from phishing or users tricked by social engineering.

Real user monitoring identifies authenticated users and tracks activity, so when unusual traffic patterns are detected, the activity is logged, and alerts are sent to administrators. This activity can be tracked on a public-facing site or an intranet where only employees have access.