A method for a cyber threat defense system comprising a privacy protection component to comply with a set of privacy requirements when displaying input data, the method comprising: identifying data fields with data values within input data as data identifiable to a network entity using one or more machine-learning models trained on known data fields and their data, where the network entity is at least one of a user and a device associated with a network being protected by the cyber threat defense system; clustering the data values with other data values having similar characteristics using at least one machine-learning model trained on known data fields with identified privacy levels used in the network to infer a privacy level associated with each data field, where a privacy level is utilized to indicate whether, at least, a first data value in a first data field should be public or anonymized; determining a privacy status of the first data field by comparing the privacy level to a permission threshold; applying an alias transform to the first data value in the first data field with a privacy alias to anonymize the first data value in the data field; presenting the privacy alias to a system user in place of the first data value; and determining a cyber threat risk parameter indicative of a likelihood of a cyber threat, by comparing analyzed metrics on user activity and network activity, based on the input data, to their respective moving benchmark of parameters that: 1) correspond to a normal pattern of life for the network used by self-learning machine-learning models, and 2) correspond to potential cyber threats, where the machine-learning models are configured to use at least unsupervised learning algorithms to establish what is the normal pattern of life for the network. identifying data fields with data values within input data as data identifiable to a network entity using one or more machine-learning models trained on known data fields and their data, where the network entity is at least one of a user and a device associated with a network being protected by the cyber threat defense system; clustering the data values with other data values having similar characteristics using at least one machine-learning model trained on known data fields with identified privacy levels used in the network to infer a privacy level associated with each data field, where a privacy level is utilized to indicate whether, at least, a first data value in a first data field should be public or anonymized; determining a privacy status of the first data field by comparing the privacy level to a permission threshold; applying an alias transform to the first data value in the first data field with a privacy alias to anonymize the first data value in the data field; presenting the privacy alias to a system user in place of the first data value; and determining a cyber threat risk parameter indicative of a likelihood of a cyber threat, by comparing analyzed metrics on user activity and network activity, based on the input data, to their respective moving benchmark of parameters that: 1) correspond to a normal pattern of life for the network used by self-learning machine-learning models, and 2) correspond to potential cyber threats, 1) correspond to a normal pattern of life for the network used by self-learning machine-learning models, and 2) correspond to potential cyber threats,