Distributions in practice: histograms, KDEs, and when the mean deceives

Statistics often starts with a simple question:

“What is the average?”

The average order value. The average server response time. The average income. The average number of products in a shopping cart.

The problem is that the word “average” usually refers to the arithmetic mean, and the mean has a weakness: it can be pulled dramatically by unusual values.

A few extremely large observations can make the mean look impressive, alarming, or misleading even when most observations look completely different.

That is why distributions matter.

A distribution describes how values are spread across a dataset. It shows whether observations cluster around a typical range, whether there are long tails, whether multiple groups exist, and whether unusual values are rare mistakes or important signals.

Before building dashboards, training models, or making business decisions, understanding distributions helps answer questions such as:

• Is the mean representative of a typical user?

• Should we optimize for the median, an average, or a percentile?

• Are extreme values errors or meaningful events?

• Does the data need transformation before analysis?

• Are we improving the majority experience or only changing the behavior of a small group?

This lesson focuses on three practical tools:

• Histograms for seeing the overall shape of numerical data.

• Kernel density estimation (KDE) for creating a smoother view of concentration and patterns.

• Robust statistics such as the median and percentiles for decisions where the mean can mislead.

The examples use everyday technical and business scenarios such as order values, incomes, and server latency.

The difference between numbers and distributions

Imagine an online store recording the value of customer orders.

A small sample might look like this:

15
18
22
24
27
31
35
42
250

The arithmetic mean is 52.7.

At first glance, that might suggest a typical order is around 53 units.

But almost nobody in this dataset placed an order worth exactly that amount. Most customers spent between 15 and 42.

The order worth 250 is not automatically wrong. It might represent a business customer purchasing in bulk, a seasonal purchase, or a special promotion.

Removing it simply because it changes the average would hide information.

This reveals an important statistical idea:

The mean describes the mathematical center of values, not necessarily the experience of a typical observation.

The median answers a different question:

“What value sits in the middle when all observations are sorted?”

For the same orders:

15, 18, 22, 24, 27, 31, 35, 42, 250

The median is:

27

Now the story changes.

The average order value is 52.7, but the typical order is closer to 27.

Neither number is universally better. They answer different questions.

If a finance team wants to estimate total revenue, the mean may be useful.

If a product manager wants to understand the typical customer, the median may be more informative.

Histograms: the first distribution tool

A histogram groups numerical values into ranges called bins.

Instead of examining thousands of individual server requests, you might group response times into ranges:

0-100 ms       ████████████████████
100-200 ms     ██████████
200-300 ms     ████
300-400 ms     ██
400-500 ms     █

A histogram quickly reveals patterns:

• A symmetric distribution often has the mean near the center.

• A right-skewed distribution has a long tail toward larger values.

• A left-skewed distribution has a tail toward smaller values.

• Multiple peaks can indicate different populations mixed together.

The choice of bins matters.

Too few bins:

0-500
████████████████

The important structure disappears.

Too many bins:

0-10
██
10-20
█
20-30
██
30-40
█
40-50
██

The chart becomes noisy.

A practical workflow is to try different bin sizes and combine the visualization with numerical summaries.

The goal is not to create the prettiest chart. The goal is to understand the process that generated the data.

Exploring skewed data with pandas

A classic example of a non-symmetric distribution is income-like data.

Many real-world financial datasets have a long right tail: many observations are concentrated in a lower or middle range, while a smaller number of very large values stretch the distribution upward.

For learning purposes, we can generate synthetic data with a similar shape.

import numpy as np
import pandas as pd
import matplotlib.pyplot as plt

np.random.seed(42)

income = np.random.lognormal(
    mean=10.5,
    sigma=0.7,
    size=5000
)

df = pd.DataFrame(
    {
        "annual_income": income
    }
)

print(df["annual_income"].describe())

print("Mean:", df["annual_income"].mean())
print("Median:", df["annual_income"].median())

df["annual_income"].hist(
    bins=50
)

plt.xlabel("Annual income")
plt.ylabel("Frequency")
plt.title("Synthetic income distribution")
plt.show()

The summary statistics tell a story.

describe() provides:

• The number of observations.

• The mean.

• Percentiles, including the median.

• Minimum and maximum values.

When the maximum is dramatically larger than the median, it is a signal to investigate the distribution.

The question is not “Are there outliers?”

The better question is:

“What process created these extreme values?”

An extreme value might be:

• A data-entry mistake.

• A rare but valid event.

• A separate customer segment.

• The most important part of the system.

Statistics begins with curiosity about the source of the numbers.

Skewness: why shape changes interpretation

Skewness describes how much a distribution leans toward one side.

A symmetric distribution has a balanced shape:

        *
      * * *
    * * * * *
  * * * * * * *
-------------------
       center

A right-skewed distribution stretches toward larger values:

      *
    * *
  * * *
* * * * * -------------------- *

In right-skewed data:

• The mean moves toward the long tail.

• The median stays closer to the majority of observations.

• A small number of large values can dominate calculations.

This matters in real decisions.

Imagine a company reporting:

“Average customer spending is 120 dollars per month.”

That sounds like a typical customer spends 120 dollars.

But if the median customer spends 45 dollars and a few enterprise customers spend thousands, the average is describing a smaller high-value group.

A product team designing for the “average customer” could accidentally build features for customers who represent only a tiny fraction of the user base.

Understanding Skewness prevents that mistake.

Kernel density estimation: seeing the shape without bins

Histograms are powerful, but they depend on bin choices.

Kernel density estimation creates a smooth estimate of the distribution by placing a small curve around each observation and combining those curves.

The idea is:

1. Each data point contributes a small amount of density.

2. Nearby contributions overlap.

3. The combined curve estimates where values are concentrated.

KDE can help reveal:

• The main cluster of observations.

• Long tails.

• Multiple groups.

• Differences between datasets.

For example, server latency often contains more than one behavior pattern.

import numpy as np
import pandas as pd
import matplotlib.pyplot as plt

np.random.seed(7)

latency = np.concatenate(
    [
        np.random.normal(120, 20, 900),
        np.random.normal(500, 80, 100)
    ]
)

df = pd.DataFrame(
    {
        "latency_ms": latency
    }
)

df["latency_ms"].plot(
    kind="kde"
)

plt.xlabel("Latency (ms)")
plt.title("Server latency density estimate")
plt.show()

This synthetic example represents a common production scenario:

• Most requests complete quickly.

• A smaller group of requests is much slower.

The mean latency combines both behaviors into one number.

The KDE suggests a more useful question:

“Why does this second group exist?”

Possible causes include:

• A slow database query.

• A problematic API endpoint.

• Resource contention.

• Background processing.

• A particular customer workflow.

The distribution points engineers toward investigation.

Why latency averages often deceive engineers

Software systems frequently display average response time.

A dashboard might show:

Average response time: 180 ms

That looks healthy.

However, users do not experience the average request. Each user experiences an individual request.

Operational monitoring often uses percentiles:

p50: 120 ms
p95: 450 ms
p99: 1800 ms

Interpretation:

• p50 means half of requests are faster and half are slower.

• p95 describes the slower edge experienced by 5% of requests.

• p99 highlights extreme delays.

For distributed systems, the tail can matter more than the average.

A small percentage of slow requests can:

• Damage user experience.

• Increase support tickets.

• Cause timeouts.

• Create failures in dependent services.

The lesson is not “never use the mean.”

The lesson is:

Choose the measurement that matches the decision.

Transformations for heavily skewed data

Some analytical methods work better when data is less stretched.

A common approach is a logarithmic transformation.

Income, response times, and business metrics often span large ranges. A log transformation compresses very large values.

import numpy as np
import pandas as pd

df = pd.DataFrame(
    {
        "latency_ms": [20, 40, 80, 200, 1000, 5000]
    }
)

df["log_latency"] = np.log1p(
    df["latency_ms"]
)

print(df)

The transformation does not remove the original behavior.

Instead, it changes the scale to make patterns easier to analyze.

A logarithmic view can be useful when:

• Values cover several orders of magnitude.

• Multiplicative effects are important.

• Large values dominate charts.

• The distribution has a strong right tail.

Always communicate results carefully. A transformed chart is useful for exploration, but stakeholders may need the original units to understand the practical impact.

The cherry on the cake: CVE-2024-3094 and the danger of ignoring the tail

Distribution thinking is not limited to analytics.

It also appears in cybersecurity.

In March 2024, researchers discovered CVE-2024-3094, a malicious backdoor introduced into certain versions of XZ Utils, a widely used open-source compression utility. The incident became one of the most notable software supply-chain security events of 2024 because a small and unusual change inside a common dependency created a potentially severe risk.

The statistical connection is simple:

Rare events can have enormous consequences.

If you only optimize for average behavior, you may ignore the unusual cases that matter most.

In security, the “tail” can include:

• A suspicious package release.

• An unusual network request.

• A rare authentication pattern.

• A small configuration change with a large impact.

The same thinking applies to:

• Fraud detection.

• Reliability engineering.

• Financial risk analysis.

• Machine learning monitoring.

• Infrastructure operations.

The tail is not always noise.

Sometimes the tail is the story.

A practical distribution analysis workflow

When receiving a numerical dataset, do not immediately calculate the mean and build a report.

Start with exploration:

• Plot a histogram.

• Compare mean and median.

• Check percentiles.

• Inspect minimum and maximum values.

• Investigate extreme observations.

• Decide whether unusual values are mistakes or meaningful events.

• Look for multiple groups hidden inside the dataset.

• Use KDE when a smoother view is useful.

• Select metrics based on the decision being made.

A dataset is not just a collection of numbers.

It is evidence of a process.

The shape of that process tells you how the system behaves.

Final thoughts

The mean is one of the most useful statistics ever created, but it is also one of the easiest to misuse.

Averages compress information. Sometimes that is exactly what you need. Other times, that compression removes the details that matter most.

Histograms reveal the shape.

KDEs reveal concentration and patterns.

Medians and percentiles reveal typical experiences when data is skewed.

The next time someone says:

“The average is 500.”

Ask:

“Is 500 what most people experience, or is it where extreme values pulled the number?”

Start your next analytics project by exploring the distribution before building dashboards, choosing success metrics, or training models. Plot the data, compare the statistics, and investigate the unusual cases.

Subscribe for the next lesson in practical data analysis, or take the next step now by opening a dataset you work with and creating your first histogram, median comparison, and distribution review.