A computer implemented method comprising: identifying a predetermined particular behavioral profile associated with at least one particular user of a computing system, the particular behavioral profile identifying expected behavior of users within a set of one or more users (130; 135) within the computing system, wherein the particular behavioral profile is based on previously detected activities of the at least one user (130,135) in the set and the set comprises the particular user; identifying, using at least one computer processing device (105, 110, 115, 120, 140, 155, 160, 165), activities associated with use of the computing system by the particular user; and determining, for each of the identified activities, whether the activity correlates with the particular behavioral profile, wherein determining that the activity deviates from the particular behavioral profile beyond a particular threshold triggers a risk event relating to the particular user and determining that the activity deviates from the particular behavioral profile within the particular threshold causes the particular behavioral profile to be revised based at least in part on the particular activity, wherein first and second users are included in a plurality of users (605, 610, 615) within the computing system and each user in the plurality of users has at least one corresponding user-based behavioral profile, characterized in: determining an aggregate risk profile for the computing system based at least in part on the user-based behavioral profile of the plurality of users and determining the aggregate risk profile for the computing system includes: identifying an association between a particular computing device (620, 625, 630) in the computing system and the particular user; determining a device risk profile of the particular computing device; and determining a composite risk associated with the particular computing device based at least in part on the device risk profile of the particular computing device and the particular behavioral profile of the particular user of the particular computing device; and determining, for each of the identified activities, whether the activity correlates with the particular aggregate behavioral profile, wherein determining that the activity deviates from the particular aggregate behavioral profile beyond a particular threshold triggers a risk event. identifying a predetermined particular behavioral profile associated with at least one particular user of a computing system, the particular behavioral profile identifying expected behavior of users within a set of one or more users (130; 135) within the computing system, wherein the particular behavioral profile is based on previously detected activities of the at least one user (130,135) in the set and the set comprises the particular user; identifying, using at least one computer processing device (105, 110, 115, 120, 140, 155, 160, 165), activities associated with use of the computing system by the particular user; and determining, for each of the identified activities, whether the activity correlates with the particular behavioral profile, wherein determining that the activity deviates from the particular behavioral profile beyond a particular threshold triggers a risk event relating to the particular user and determining that the activity deviates from the particular behavioral profile within the particular threshold causes the particular behavioral profile to be revised based at least in part on the particular activity, wherein first and second users are included in a plurality of users (605, 610, 615) within the computing system and each user in the plurality of users has at least one corresponding user-based behavioral profile, characterized in: determining an aggregate risk profile for the computing system based at least in part on the user-based behavioral profile of the plurality of users and determining the aggregate risk profile for the computing system includes: identifying an association between a particular computing device (620, 625, 630) in the computing system and the particular user; determining a device risk profile of the particular computing device; and determining a composite risk associated with the particular computing device based at least in part on the device risk profile of the particular computing device and the particular behavioral profile of the particular user of the particular computing device; and determining, for each of the identified activities, whether the activity correlates with the particular aggregate behavioral profile, wherein determining that the activity deviates from the particular aggregate behavioral profile beyond a particular threshold triggers a risk event. identifying an association between a particular computing device (620, 625, 630) in the computing system and the particular user; determining a device risk profile of the particular computing device; and determining a composite risk associated with the particular computing device based at least in part on the device risk profile of the particular computing device and the particular behavioral profile of the particular user of the particular computing device; and determining, for each of the identified activities, whether the activity correlates with the particular aggregate behavioral profile, wherein determining that the activity deviates from the particular aggregate behavioral profile beyond a particular threshold triggers a risk event.