At least one device configured to operate as a remote resource, comprising: a communication module to interact with a plurality of user devices (102A-102n); and a user behavior classification engine to: receive a snapshot of user device operation and user data from a first user device of the plurality of user devices; determine if a new user account is needed based at least on the user data; establish a new user account if it is determined that a new user account is needed; associate the first user device with an existing user account or the new user account; verify if the first user device is new and clean based at least on the snapshot received from the first user device of the plurality of user devices and two or more snapshots (110B - 110n) received from two or more user devices (102B-102n) of the plurality of user devices, wherein the two or more snapshots are utilized to formulate a baseline operational configuration against which the snapshot received from the first user device is compared, wherein a clean device is a device at least free from malware; provide results of the verification to the first user device; develop a user classification to classify at least one type of use for the first user device, if the first user device is clean, based at least on the snapshot, and utilize the user classification to determine whether the first user device comprises a threat based on a further received snapshot of user device operation. a communication module to interact with a plurality of user devices (102A-102n); and a user behavior classification engine to: receive a snapshot of user device operation and user data from a first user device of the plurality of user devices; determine if a new user account is needed based at least on the user data; establish a new user account if it is determined that a new user account is needed; associate the first user device with an existing user account or the new user account; verify if the first user device is new and clean based at least on the snapshot received from the first user device of the plurality of user devices and two or more snapshots (110B - 110n) received from two or more user devices (102B-102n) of the plurality of user devices, wherein the two or more snapshots are utilized to formulate a baseline operational configuration against which the snapshot received from the first user device is compared, wherein a clean device is a device at least free from malware; provide results of the verification to the first user device; develop a user classification to classify at least one type of use for the first user device, if the first user device is clean, based at least on the snapshot, and utilize the user classification to determine whether the first user device comprises a threat based on a further received snapshot of user device operation. receive a snapshot of user device operation and user data from a first user device of the plurality of user devices; determine if a new user account is needed based at least on the user data; establish a new user account if it is determined that a new user account is needed; associate the first user device with an existing user account or the new user account; verify if the first user device is new and clean based at least on the snapshot received from the first user device of the plurality of user devices and two or more snapshots (110B - 110n) received from two or more user devices (102B-102n) of the plurality of user devices, wherein the two or more snapshots are utilized to formulate a baseline operational configuration against which the snapshot received from the first user device is compared, wherein a clean device is a device at least free from malware; provide results of the verification to the first user device; develop a user classification to classify at least one type of use for the first user device, if the first user device is clean, based at least on the snapshot, and utilize the user classification to determine whether the first user device comprises a threat based on a further received snapshot of user device operation.