An apparatus, comprising: one or more machine learning models that are trained on a normal behavior of both email activity and user activity associated with an email system; a cyber-threat module with one or more machine learning models trained on cyber threats in the email system to understand characteristics of cyber threats in the email system, where the cyber-threat module is configured to also: reference the models that are trained on the normal behavior of both email activity and user activity associated with the email system; and issue an anomaly rating value to indicate how unusual the cyber-threat module considers an email under analysis to be in comparison to a normal pattern of life for an organization and a specific user, where the cyber-threat module determines a threat risk parameter that factors in the likelihood that a chain of one or more unusual behaviors of the email activity and user activity under analysis that fall outside of a derived normal benign behavior, and how the chain of one or more unusual behaviors of the email activity and user activity under analysis correlate to a potential cyber threat; probes configured to collect both the user activity and the email activity and then feed that activity to the cyber-threat module to draw an understanding of the email activity and user activity in the email system; and an autonomous response module, rather than a human taking an action, configured to cause one or more autonomous actions to be taken to contain the cyber-threat when the threat risk parameter from the cyber-threat module is equal to or above an actionable threshold. one or more machine learning models that are trained on a normal behavior of both email activity and user activity associated with an email system; a cyber-threat module with one or more machine learning models trained on cyber threats in the email system to understand characteristics of cyber threats in the email system, where the cyber-threat module is configured to also: reference the models that are trained on the normal behavior of both email activity and user activity associated with the email system; and issue an anomaly rating value to indicate how unusual the cyber-threat module considers an email under analysis to be in comparison to a normal pattern of life for an organization and a specific user, where the cyber-threat module determines a threat risk parameter that factors in the likelihood that a chain of one or more unusual behaviors of the email activity and user activity under analysis that fall outside of a derived normal benign behavior, and how the chain of one or more unusual behaviors of the email activity and user activity under analysis correlate to a potential cyber threat; probes configured to collect both the user activity and the email activity and then feed that activity to the cyber-threat module to draw an understanding of the email activity and user activity in the email system; and an autonomous response module, rather than a human taking an action, configured to cause one or more autonomous actions to be taken to contain the cyber-threat when the threat risk parameter from the cyber-threat module is equal to or above an actionable threshold.