A server computer system comprising at least one hardware processor configured to: in response to receiving an indication of an occurrence of a target event on a target client system, assemble (254 an event sequence (25 including the target event, all events of the event sequence having occurred on the target client system, wherein members of the event sequence are arranged according to a time of occurrence of each event of the event sequence; in response to receiving the indication, select a parameter value from a plurality of parameter values according to the target client system; in response to selecting the parameter value, instantiate a behavior model with the parameter value, the behavior model configured to input a selected event of the event sequence and in response, to produce a prediction indicator indicative of a likelihood that the event sequence includes the target event; and in response to instantiating the behavior model, determine whether the target event is indicative of a computer security threat according to the prediction indicator; wherein: the plurality of parameter values are determined according to a training corpus of events having occurred on a plurality of client systems grouped into a plurality of client clusters; each of the plurality of parameter values is determined according to a distinct subset of the training corpus, each distinct subset having occurred on members of a distinct cluster of a plurality of client clusters; and selecting the parameter value comprises selecting a target cluster from the plurality of client clusters according to the target client system, and selecting the parameter value according to the target cluster. in response to receiving an indication of an occurrence of a target event on a target client system, assemble (254 an event sequence (25 including the target event, all events of the event sequence having occurred on the target client system, wherein members of the event sequence are arranged according to a time of occurrence of each event of the event sequence; in response to receiving the indication, select a parameter value from a plurality of parameter values according to the target client system; in response to selecting the parameter value, instantiate a behavior model with the parameter value, the behavior model configured to input a selected event of the event sequence and in response, to produce a prediction indicator indicative of a likelihood that the event sequence includes the target event; and in response to instantiating the behavior model, determine whether the target event is indicative of a computer security threat according to the prediction indicator; wherein: the plurality of parameter values are determined according to a training corpus of events having occurred on a plurality of client systems grouped into a plurality of client clusters; each of the plurality of parameter values is determined according to a distinct subset of the training corpus, each distinct subset having occurred on members of a distinct cluster of a plurality of client clusters; and selecting the parameter value comprises selecting a target cluster from the plurality of client clusters according to the target client system, and selecting the parameter value according to the target cluster.