A computerized method for determining M -score for use in detecting data leakage and data misuse in a computer system belonging to an organization, wherein said computer system comprises: a) at least one database that contains said organization's data; b) at least one application server configured to receive queries from users, to communicate with and receive data from at least one of said databases, and to construct from said data a publication, which is a table comprising data records; c) at least one user device configured to be used by a user to send queries to said at least one application server and to receive publications returned by said application server; d) at least one M -score server configured to determine a M -score for all publications returned by said application servers to all queries submitted by said user during a time frame F; and e) communication links between the components of said system, characterized in that, said method, which is executed by said at least one M -score server, comprises carrying out a recursive Construct Publication Ensemble procedure comprising the following steps: A) if no previous publications exist, return new publication T n; B) if previous publications exist, create for each new publication an ensemble set E of all the previous publications that are within the time frame F; C) return a resulting ensemble set E; and D) determine the M -score for the publication T n returned in step A or for the ensemble of publications E returned in step C according to the following four step procedure: i) determining a raw record score for each record in the publication or ensemble; ii) determining a record distinguishing factor for each record in the publication or ensemble; iii) determining a final record score for the publication or ensemble using said distinguishing factor and said raw record score; and iv) combining said final record score with a quantity factor in order to determine said M -score for the publication or ensemble. a) at least one database that contains said organization's data; b) at least one application server configured to receive queries from users, to communicate with and receive data from at least one of said databases, and to construct from said data a publication, which is a table comprising data records; c) at least one user device configured to be used by a user to send queries to said at least one application server and to receive publications returned by said application server; d) at least one M -score server configured to determine a M -score for all publications returned by said application servers to all queries submitted by said user during a time frame F; and e) communication links between the components of said system, characterized in that, said method, which is executed by said at least one M -score server, comprises carrying out a recursive Construct Publication Ensemble procedure comprising the following steps: A) if no previous publications exist, return new publication T n; B) if previous publications exist, create for each new publication an ensemble set E of all the previous publications that are within the time frame F; C) return a resulting ensemble set E; and D) determine the M -score for the publication T n returned in step A or for the ensemble of publications E returned in step C according to the following four step procedure: i) determining a raw record score for each record in the publication or ensemble; ii) determining a record distinguishing factor for each record in the publication or ensemble; iii) determining a final record score for the publication or ensemble using said distinguishing factor and said raw record score; and iv) combining said final record score with a quantity factor in order to determine said M -score for the publication or ensemble. A) if no previous publications exist, return new publication T n; B) if previous publications exist, create for each new publication an ensemble set E of all the previous publications that are within the time frame F; C) return a resulting ensemble set E; and D) determine the M -score for the publication T n returned in step A or for the ensemble of publications E returned in step C according to the following four step procedure: i) determining a raw record score for each record in the publication or ensemble; ii) determining a record distinguishing factor for each record in the publication or ensemble; iii) determining a final record score for the publication or ensemble using said distinguishing factor and said raw record score; and iv) combining said final record score with a quantity factor in order to determine said M -score for the publication or ensemble. i) determining a raw record score for each record in the publication or ensemble; ii) determining a record distinguishing factor for each record in the publication or ensemble; iii) determining a final record score for the publication or ensemble using said distinguishing factor and said raw record score; and iv) combining said final record score with a quantity factor in order to determine said M -score for the publication or ensemble.