A computing device comprising a computer memory and a computer processor that is configured to allow a personal digital assistant to control access to secure computing resources based on a measure of legitimacy for a current user, the computing device comprising: the personal digital assistant that is a computer program stored on the computer memory having computer instructions that when executed by the computer processor cause the personal digital assistant to: monitor user-related activity for a current user-session on the computing device; determine an authentication confidence score for the current user associated with the current user-session on the computing device, the authentication confidence score determined based on a comparison of information from the monitored user-related activity and a persona model corresponding to a legitimate user associated with the computing device, wherein the persona model is determined from user-related activity information of the legitimate user; receive an indication of a request to access a first secure computing resource from a set of secure computing resources; determine (445, 540) that the determined authentication confidence score does not indicate that the current user is likely to be the legitimate user; when it is determined that the current user likely is not the legitimate user, generate a security challenge based on the persona model corresponding to the legitimate user and cause the security challenge to be presented via the computing device, wherein the security challenge comprises a question and corresponding answer derived from a portion of the user-related activity information of the legitimate user that occurred within the past seven days; receive a response to the security challenge; evaluate the response to the security challenge; update the determined authentication confidence score based on the received response, and provide access to the first secure computing resource or restrict access to the first secure computing resource according to the updated authentication confidence score. monitor user-related activity for a current user-session on the computing device; determine an authentication confidence score for the current user associated with the current user-session on the computing device, the authentication confidence score determined based on a comparison of information from the monitored user-related activity and a persona model corresponding to a legitimate user associated with the computing device, wherein the persona model is determined from user-related activity information of the legitimate user; receive an indication of a request to access a first secure computing resource from a set of secure computing resources; determine (445, 540) that the determined authentication confidence score does not indicate that the current user is likely to be the legitimate user; when it is determined that the current user likely is not the legitimate user, generate a security challenge based on the persona model corresponding to the legitimate user and cause the security challenge to be presented via the computing device, wherein the security challenge comprises a question and corresponding answer derived from a portion of the user-related activity information of the legitimate user that occurred within the past seven days; receive a response to the security challenge; evaluate the response to the security challenge; update the determined authentication confidence score based on the received response, and provide access to the first secure computing resource or restrict access to the first secure computing resource according to the updated authentication confidence score.