A cyber security appliance, the cyber security appliance comprising: a cloud module; a SaaS module; a cyber threat module; a user interface; and a coordinator module; where the cloud module and the SaaS module are configured to cooperate by collecting data to contextualize cloud and SaaS events to link those events and better understand an entity's behavior by considering SaaS metrics and events as well as cloud metrics and events as an interconnected whole rather than separate realms, where the modules in the cyber security appliance are configured to communicate with a set of probes that integrate Software-as-a-Service analysis and a cloud analysis; where the cloud module is configured to monitor cloud activity, and the SaaS module is configured to monitor SaaS application activity to each feed their data to the coordinator module to correlate causal links between these behavioral activities to supply this input into the cyber threat module, where the user interface is configured to cooperate with at least the cloud module to display and allow a viewer of the user interface on a display screen to contextualize the cloud and SaaS events in light of network traffic from the set of probes on a same user interface, where the user interface is configured to allow the viewer to pivot between SaaS metrics and cloud metrics to link those events and understand at least the entity's behavior by considering the SaaS metrics and events as well as the cloud metrics and events as an interconnected whole rather than separate realms; where the cyber threat module is configured to factor behavioral activity in a first environment of SaaS to a particular causal link in a second environment of cloud infrastructure into its determination of a threat risk parameter; and where the cyber threat module is configured to reference models that are trained on a normal behavior of, at least, the cloud activity and the SaaS activity associated with an organization's network, where the cyber threat module is configured to determine the threat risk parameter that factors in i) how a chain of unusual behavior correlates to potential cyber threats and ii) what is a likelihood of the chain of one or more unusual behaviors of, at least, the SaaS activity and the cloud activity that fall outside of being a normal benign behavior is potentially malicious behavior. a cloud module; a SaaS module; a cyber threat module; a user interface; and a coordinator module; where the cloud module and the SaaS module are configured to cooperate by collecting data to contextualize cloud and SaaS events to link those events and better understand an entity's behavior by considering SaaS metrics and events as well as cloud metrics and events as an interconnected whole rather than separate realms, where the modules in the cyber security appliance are configured to communicate with a set of probes that integrate Software-as-a-Service analysis and a cloud analysis; where the cloud module is configured to monitor cloud activity, and the SaaS module is configured to monitor SaaS application activity to each feed their data to the coordinator module to correlate causal links between these behavioral activities to supply this input into the cyber threat module, where the user interface is configured to cooperate with at least the cloud module to display and allow a viewer of the user interface on a display screen to contextualize the cloud and SaaS events in light of network traffic from the set of probes on a same user interface, where the user interface is configured to allow the viewer to pivot between SaaS metrics and cloud metrics to link those events and understand at least the entity's behavior by considering the SaaS metrics and events as well as the cloud metrics and events as an interconnected whole rather than separate realms; where the cyber threat module is configured to factor behavioral activity in a first environment of SaaS to a particular causal link in a second environment of cloud infrastructure into its determination of a threat risk parameter; and where the cyber threat module is configured to reference models that are trained on a normal behavior of, at least, the cloud activity and the SaaS activity associated with an organization's network, where the cyber threat module is configured to determine the threat risk parameter that factors in i) how a chain of unusual behavior correlates to potential cyber threats and ii) what is a likelihood of the chain of one or more unusual behaviors of, at least, the SaaS activity and the cloud activity that fall outside of being a normal benign behavior is potentially malicious behavior.