A process for providing cybersecurity by automatically scoring a storage item access attempt with respect to intrusion risk, the process comprising: automatically forming a tuple-to-score, in response to an attempt by a user to access a storage item, the tuple-to-score including an accessor ID and a storage item ID, the accessor ID associated with the user and the storage item ID identifying the storage item relative to other storage items; automatically computing a recommendation score at least in part by collaboratively filtering a plurality of scored-tuples, each scored-tuple including a) an accessor ID which differs from the accessor ID of the tuple-to-score, b) a storage item ID which matches the storage item ID of the tuple-to-score, and c) a recommendation score corresponding to the scored-tuple's accessor ID and storage item ID; and automatically taking at least one of the following actions based at least in part on the computed recommendation score, thereby using the recommendation score as an inverse measure of intrusion risk: preventing or terminating access to the storage item by the user when the computed recommendation score is lower than a specified access-prevention threshold; alerting an administrator or a security monitoring task to the access to the storage item by the user when the computed recommendation score is lower than a specified access-alert threshold; or allowing the user to access the storage item when the computed recommendation score is above a specified access-allowable threshold. automatically forming a tuple-to-score, in response to an attempt by a user to access a storage item, the tuple-to-score including an accessor ID and a storage item ID, the accessor ID associated with the user and the storage item ID identifying the storage item relative to other storage items; automatically computing a recommendation score at least in part by collaboratively filtering a plurality of scored-tuples, each scored-tuple including a) an accessor ID which differs from the accessor ID of the tuple-to-score, b) a storage item ID which matches the storage item ID of the tuple-to-score, and c) a recommendation score corresponding to the scored-tuple's accessor ID and storage item ID; and automatically taking at least one of the following actions based at least in part on the computed recommendation score, thereby using the recommendation score as an inverse measure of intrusion risk: preventing or terminating access to the storage item by the user when the computed recommendation score is lower than a specified access-prevention threshold; alerting an administrator or a security monitoring task to the access to the storage item by the user when the computed recommendation score is lower than a specified access-alert threshold; or allowing the user to access the storage item when the computed recommendation score is above a specified access-allowable threshold. preventing or terminating access to the storage item by the user when the computed recommendation score is lower than a specified access-prevention threshold; alerting an administrator or a security monitoring task to the access to the storage item by the user when the computed recommendation score is lower than a specified access-alert threshold; or allowing the user to access the storage item when the computed recommendation score is above a specified access-allowable threshold.