A method for identifying outlier network activity that poses a threat to the cybersecurity of a service provider providing one or more services to a plurality of users via the Internet, the method comprising: monitoring, by a processor, activity by the plurality of users; compiling, by the processor, a plurality of data sets based on the monitoring, each of the plurality data sets including information representative of the network activity by the plurality of users; constructing, by the processor, a network model based on one or more of the plurality of data sets, wherein the network model includes a plurality of nodes and is representative of at least a portion of the network activity, and wherein each of the plurality of nodes corresponds to one of the plurality of users; evaluating, by the processor, the network model against a set of rules to produce a plurality of outputs, wherein the plurality of outputs, for each of the plurality of users, includes: classification, link metric, and a community, wherein the classification identifies a user corresponding to a node as an outlier or a non-outlier, wherein the link metric indicates a strength of a connection between two users of the plurality of users, and wherein the community identifies a subgroup of closely connected users of the plurality of users; executing, by the processor, decision engine logic against the plurality of outputs to identify outlier network activity; executing, by the processor, at least one process to mitigate identified outlier network activity, wherein the at least one process to mitigate the identified outlier network activity includes: disabling access by a user to a network, disabling access by a user to a network resource, and disabling access by a user to a service; receiving, by the processor, feedback regarding the identified outlier network activity, wherein the feedback indicates whether the decision engine correctly identified network activity as outlier network activity; and modifying at least one of: the network model, the set of rules, and the decision engine in response to receiving feedback that indicates incorrectly identified outlier network activity. monitoring, by a processor, activity by the plurality of users; compiling, by the processor, a plurality of data sets based on the monitoring, each of the plurality data sets including information representative of the network activity by the plurality of users; constructing, by the processor, a network model based on one or more of the plurality of data sets, wherein the network model includes a plurality of nodes and is representative of at least a portion of the network activity, and wherein each of the plurality of nodes corresponds to one of the plurality of users; evaluating, by the processor, the network model against a set of rules to produce a plurality of outputs, wherein the plurality of outputs, for each of the plurality of users, includes: classification, link metric, and a community, wherein the classification identifies a user corresponding to a node as an outlier or a non-outlier, wherein the link metric indicates a strength of a connection between two users of the plurality of users, and wherein the community identifies a subgroup of closely connected users of the plurality of users; classification, link metric, and a community, wherein the classification identifies a user corresponding to a node as an outlier or a non-outlier, wherein the link metric indicates a strength of a connection between two users of the plurality of users, and wherein the community identifies a subgroup of closely connected users of the plurality of users; wherein the classification identifies a user corresponding to a node as an outlier or a non-outlier, wherein the link metric indicates a strength of a connection between two users of the plurality of users, and wherein the community identifies a subgroup of closely connected users of the plurality of users; executing, by the processor, decision engine logic against the plurality of outputs to identify outlier network activity; executing, by the processor, at least one process to mitigate identified outlier network activity, wherein the at least one process to mitigate the identified outlier network activity includes: disabling access by a user to a network, disabling access by a user to a network resource, and disabling access by a user to a service; disabling access by a user to a network, disabling access by a user to a network resource, and disabling access by a user to a service; receiving, by the processor, feedback regarding the identified outlier network activity, wherein the feedback indicates whether the decision engine correctly identified network activity as outlier network activity; and modifying at least one of: the network model, the set of rules, and the decision engine in response to receiving feedback that indicates incorrectly identified outlier network activity.