A computerized method performed by one or more computer systems configured to access one or more electronic data sources in response to requests received from an interactive user interface, the method comprising: obtaining logs from a plurality of network accessible systems associated with one or more networks, the logs generated by the network accessible systems in response to network actions of a plurality of user accounts associated with the networks, and the logs specifying information associated with network actions of user accounts that affect one or more network accessible systems or one or more user accounts; determining respective network actions of the user accounts based on the logs, wherein one or more determined network actions of a particular user account include transitions to one or more subsequent user accounts; maintaining, in one or more databases, information identifying the respective network actions of the user accounts; determining, for each of the user accounts, one or more user compromise scores associated with the user account, based on network actions of the user account identified in the one or more databases, the user compromise scores measuring respective types-of user behavior associated with a risk of compromise, wherein the user compromise scores include a user chaining score, and wherein determining the user chaining score for the particular user account is based, at least in part, on escalations of user privileges associated with transitions to the subsequent user accounts; determining, based on the user compromise scores associated with each user account, a set of user accounts of the plurality of user accounts for review; and providing, for presentation in an interactive user interface, information describing user accounts of the set of user accounts and respective user compromise scores associated with user accounts of the set of user accounts, wherein the interactive user interface presents, for the particular user account, information identifying, at least, a transition to a first subsequent user account with escalated privileges, the presented information specifying that the first subsequent user account is associated with a different employee than the particular user account. obtaining logs from a plurality of network accessible systems associated with one or more networks, the logs generated by the network accessible systems in response to network actions of a plurality of user accounts associated with the networks, and the logs specifying information associated with network actions of user accounts that affect one or more network accessible systems or one or more user accounts; determining respective network actions of the user accounts based on the logs, wherein one or more determined network actions of a particular user account include transitions to one or more subsequent user accounts; maintaining, in one or more databases, information identifying the respective network actions of the user accounts; determining, for each of the user accounts, one or more user compromise scores associated with the user account, based on network actions of the user account identified in the one or more databases, the user compromise scores measuring respective types-of user behavior associated with a risk of compromise, wherein the user compromise scores include a user chaining score, and wherein determining the user chaining score for the particular user account is based, at least in part, on escalations of user privileges associated with transitions to the subsequent user accounts; determining, based on the user compromise scores associated with each user account, a set of user accounts of the plurality of user accounts for review; and providing, for presentation in an interactive user interface, information describing user accounts of the set of user accounts and respective user compromise scores associated with user accounts of the set of user accounts, wherein the interactive user interface presents, for the particular user account, information identifying, at least, a transition to a first subsequent user account with escalated privileges, the presented information specifying that the first subsequent user account is associated with a different employee than the particular user account.