A computer-implemented method for detecting unknown security threats, the method comprising: receiving from an antivirus application deployed on a user's computer information about an unknown security event associated with a software object executing on said computer, and receiving from said antivirus application a user's verdict indicating that the software object is harmful or harmless to the security of said computer; identifying the user of said computer and a role of said user, wherein the user's role indicates user's level of expertise in the field of computer security being determined by the steps of - receiving from the antivirus application deployed on the user's computer information about security of the user's computer and history of user's usage of the antivirus application, - categorizing by a system the received information into a plurality of categories, including at least one of (i) a total number of computer threats detected by the user, (ii) a frequency of malware infections of the user's computer, and (iii) a level of user's proficiency with the antivirus software and - selecting by the system one or more condition-action rules for each category of information and applying the selected condition-action rules to the categorized information to determine the user's level of expertise in the field of computer security, if the role of said user indicates that the user has a high level of expertise in the field of computer security, accepting the user's verdict that the software object is harmful or harmless; if the role of said user indicates that the user has a low level of expertise in the field of computer security, analyzing the information about the security event received from the antivirus application to verify that the user's verdict is correct; and if the user's verdict was accepted or verified to be correct, updating an antivirus database, which is associated with the antivirus application and contains information about known harmful and harmless software objects, with said information about the security event and indication that associated software object is harmful or harmless. receiving from an antivirus application deployed on a user's computer information about an unknown security event associated with a software object executing on said computer, and receiving from said antivirus application a user's verdict indicating that the software object is harmful or harmless to the security of said computer; identifying the user of said computer and a role of said user, wherein the user's role indicates user's level of expertise in the field of computer security being determined by the steps of - receiving from the antivirus application deployed on the user's computer information about security of the user's computer and history of user's usage of the antivirus application, - categorizing by a system the received information into a plurality of categories, including at least one of (i) a total number of computer threats detected by the user, (ii) a frequency of malware infections of the user's computer, and (iii) a level of user's proficiency with the antivirus software and - selecting by the system one or more condition-action rules for each category of information and applying the selected condition-action rules to the categorized information to determine the user's level of expertise in the field of computer security, - receiving from the antivirus application deployed on the user's computer information about security of the user's computer and history of user's usage of the antivirus application, - categorizing by a system the received information into a plurality of categories, including at least one of (i) a total number of computer threats detected by the user, (ii) a frequency of malware infections of the user's computer, and (iii) a level of user's proficiency with the antivirus software and - selecting by the system one or more condition-action rules for each category of information and applying the selected condition-action rules to the categorized information to determine the user's level of expertise in the field of computer security, if the role of said user indicates that the user has a high level of expertise in the field of computer security, accepting the user's verdict that the software object is harmful or harmless; if the role of said user indicates that the user has a low level of expertise in the field of computer security, analyzing the information about the security event received from the antivirus application to verify that the user's verdict is correct; and if the user's verdict was accepted or verified to be correct, updating an antivirus database, which is associated with the antivirus application and contains information about known harmful and harmless software objects, with said information about the security event and indication that associated software object is harmful or harmless.