A system for controlling device security, the system comprising: at least one hardware device processor (312, 501); one or more supervised learning models (316a, 316b, 316n); and a controller that controls device security by: obtaining a first set of device activity data indicating current device activity on a device; obtaining a second set of user activity data indicating a current activity state of one or more legitimate users of the device; determining whether the indicated current activity state of the one or more legitimate users indicates that at least one of the one or more legitimate users is in an active state on the device, or that none of the one or more legitimate users is in an active state on the device; determining a statistical fit of the indicated current device activity on the device, with the indicated current activity state of the one or more legitimate users, by a comparison with at least one of the one or more supervised learning models, including: determining a probability of occurrence of at least one device activity event that is indicated in the first set of device activity data, given the indicted current activity state of the one or more legitimate users, and determining whether the determined probability is below a predetermined fitness threshold value, wherein the determination of the statistical fit indicates a compromised state if the determined probability is below the predetermined fitness threshold value; and initiating a security alert action, based on a result of the determination of the statistical fit indicating a compromised state of the device. at least one hardware device processor (312, 501); one or more supervised learning models (316a, 316b, 316n); and a controller that controls device security by: obtaining a first set of device activity data indicating current device activity on a device; obtaining a second set of user activity data indicating a current activity state of one or more legitimate users of the device; determining whether the indicated current activity state of the one or more legitimate users indicates that at least one of the one or more legitimate users is in an active state on the device, or that none of the one or more legitimate users is in an active state on the device; determining a statistical fit of the indicated current device activity on the device, with the indicated current activity state of the one or more legitimate users, by a comparison with at least one of the one or more supervised learning models, including: determining a probability of occurrence of at least one device activity event that is indicated in the first set of device activity data, given the indicted current activity state of the one or more legitimate users, and determining whether the determined probability is below a predetermined fitness threshold value, wherein the determination of the statistical fit indicates a compromised state if the determined probability is below the predetermined fitness threshold value; and initiating a security alert action, based on a result of the determination of the statistical fit indicating a compromised state of the device. obtaining a first set of device activity data indicating current device activity on a device; obtaining a second set of user activity data indicating a current activity state of one or more legitimate users of the device; determining whether the indicated current activity state of the one or more legitimate users indicates that at least one of the one or more legitimate users is in an active state on the device, or that none of the one or more legitimate users is in an active state on the device; determining a statistical fit of the indicated current device activity on the device, with the indicated current activity state of the one or more legitimate users, by a comparison with at least one of the one or more supervised learning models, including: determining a probability of occurrence of at least one device activity event that is indicated in the first set of device activity data, given the indicted current activity state of the one or more legitimate users, and determining whether the determined probability is below a predetermined fitness threshold value, wherein the determination of the statistical fit indicates a compromised state if the determined probability is below the predetermined fitness threshold value; and determining a probability of occurrence of at least one device activity event that is indicated in the first set of device activity data, given the indicted current activity state of the one or more legitimate users, and determining whether the determined probability is below a predetermined fitness threshold value, wherein the determination of the statistical fit indicates a compromised state if the determined probability is below the predetermined fitness threshold value; and initiating a security alert action, based on a result of the determination of the statistical fit indicating a compromised state of the device.