A method for detecting and thwarting attacks on a computing system, comprising: collecting, by a first computing device, timestamped data from a plurality of different software products comprising at least two of a unified end point management product, a Server Based Computing and App and Desktop Virtualization product, an application delivery controller product, a content collaboration product, and a software defined wide area network product; analyzing, by the first computing device, the collected timestamped data to determine if an observed user behavior matches a learned normal user behavior of an authorized user associated with a user account; when a first criteria is met, determining a risk classification level associated with a credential used by a user of a second computing device to log into the user account, where the first criteria is met when the observed user behavior does not match the learned normal user behavior of the authorized user; triggering an increase to the risk classification level when a second criteria is met, the second criteria (a) being different from the first criteria and (b) being related to at least one of a black listing of the second computing device, the second computing device being a rooted or jail-broken device, and the second computing device being a non-enterprise issued device; and causing at least one security related action to be performed by the first computing device or the second computing device when the increased risk classification level is greater than a threshold level or the increased risk classification level is one of a top N highest risk classification levels. collecting, by a first computing device, timestamped data from a plurality of different software products comprising at least two of a unified end point management product, a Server Based Computing and App and Desktop Virtualization product, an application delivery controller product, a content collaboration product, and a software defined wide area network product; analyzing, by the first computing device, the collected timestamped data to determine if an observed user behavior matches a learned normal user behavior of an authorized user associated with a user account; when a first criteria is met, determining a risk classification level associated with a credential used by a user of a second computing device to log into the user account, where the first criteria is met when the observed user behavior does not match the learned normal user behavior of the authorized user; triggering an increase to the risk classification level when a second criteria is met, the second criteria (a) being different from the first criteria and (b) being related to at least one of a black listing of the second computing device, the second computing device being a rooted or jail-broken device, and the second computing device being a non-enterprise issued device; and causing at least one security related action to be performed by the first computing device or the second computing device when the increased risk classification level is greater than a threshold level or the increased risk classification level is one of a top N highest risk classification levels.