A system (102A-102M, 106A-106N, 400, 500) to use weighted peer groups to selectively trigger a security alert, the system (102A-102M, 106A-106N, 400, 500) comprising: a memory (504, 508, 510); and one or more processors coupled to the memory (504, 508, 510), the one or more processors configured to: determine that an entity performs an operation, the entity having a plurality of peers that are categorized among a pluraltiy of peer groups, each peer of the entity having a relationship with the entity, each peer group including a respective subset of the peers, the peers in each subset having a respective type of relationship with the entity; for each peer group in the plurality of peer groups, determine an extent to which the peers in the peer group perform the operation; assign a plurality of weights to the plurality of respective peer groups, each weight indicating an extent to which attributes of the entity correspond to attributes of the peers in the respective peer group; for each peer group in the plurality of peer groups, combine the extent to which the peers in the peer group perform the operation and the weight that is assigned to the peer group to provide a respective weighted group value; assign a risk score, which is based at least in part on the weighted group values of the peer groups, to the operation; and selectively trigger the security alert regarding the operation based at least in part on the risk score. a memory (504, 508, 510); and one or more processors coupled to the memory (504, 508, 510), the one or more processors configured to: determine that an entity performs an operation, the entity having a plurality of peers that are categorized among a pluraltiy of peer groups, each peer of the entity having a relationship with the entity, each peer group including a respective subset of the peers, the peers in each subset having a respective type of relationship with the entity; for each peer group in the plurality of peer groups, determine an extent to which the peers in the peer group perform the operation; assign a plurality of weights to the plurality of respective peer groups, each weight indicating an extent to which attributes of the entity correspond to attributes of the peers in the respective peer group; for each peer group in the plurality of peer groups, combine the extent to which the peers in the peer group perform the operation and the weight that is assigned to the peer group to provide a respective weighted group value; assign a risk score, which is based at least in part on the weighted group values of the peer groups, to the operation; and selectively trigger the security alert regarding the operation based at least in part on the risk score. determine that an entity performs an operation, the entity having a plurality of peers that are categorized among a pluraltiy of peer groups, each peer of the entity having a relationship with the entity, each peer group including a respective subset of the peers, the peers in each subset having a respective type of relationship with the entity; for each peer group in the plurality of peer groups, determine an extent to which the peers in the peer group perform the operation; assign a plurality of weights to the plurality of respective peer groups, each weight indicating an extent to which attributes of the entity correspond to attributes of the peers in the respective peer group; for each peer group in the plurality of peer groups, combine the extent to which the peers in the peer group perform the operation and the weight that is assigned to the peer group to provide a respective weighted group value; assign a risk score, which is based at least in part on the weighted group values of the peer groups, to the operation; and selectively trigger the security alert regarding the operation based at least in part on the risk score.