Threats rarely arrive as obvious attacks. They show up as small changes in behaviour inside an app, an account or a device.