A method of regulating a digital security system, the digital security system controlling access to a resource according to a multi-level security protocol including a high-security-level access protocol and a low-security-level access protocol, the method comprising, independently of any user access request to the resource, the steps of: collecting data from a set of user-data sources (Sa,Sb,Sc), the collected data comprising information indicative of user activity; based on the collected data, computing a set of one or more security parameters characterizing user activity; comparing the computed set of security parameters to a digital profile, the digital profile representing a model of behaviour that is characteristic of said user, and responsive to the comparing indicating that the user activity is inconsistent with the digital behaviour profile, controlling the operating state of the digital security system in a pre-emptive and preventive manner, independently of any user access request to the resource, to set the digital security system in an operating state wherein the digital security system will automatically implement the high-security-level access protocol when said user makes an access request to the resource at a future time; characterized in that: the multi-level security protocol comprises an intermediate-security-level access protocol, when the comparing indicates that the user activity departs from the digital behaviour profile,, a set of one or more exception rules is applied to calculate whether or not the user activity conforms to acceptable behaviour, and when the calculation determines that the user activity conforms to acceptable behaviour defined by an exception rule, the comparing indicates that the user activity is consistent with the digital behaviour profile and the digital security system is regulated to be in an operating state wherein the digital security system will automatically implement the intermediate-security-level access protocol when said user requests access to the resource in the future. collecting data from a set of user-data sources (Sa,Sb,Sc), the collected data comprising information indicative of user activity; based on the collected data, computing a set of one or more security parameters characterizing user activity; comparing the computed set of security parameters to a digital profile, the digital profile representing a model of behaviour that is characteristic of said user, and responsive to the comparing indicating that the user activity is inconsistent with the digital behaviour profile, controlling the operating state of the digital security system in a pre-emptive and preventive manner, independently of any user access request to the resource, to set the digital security system in an operating state wherein the digital security system will automatically implement the high-security-level access protocol when said user makes an access request to the resource at a future time; characterized in that: the multi-level security protocol comprises an intermediate-security-level access protocol, when the comparing indicates that the user activity departs from the digital behaviour profile,, a set of one or more exception rules is applied to calculate whether or not the user activity conforms to acceptable behaviour, and when the calculation determines that the user activity conforms to acceptable behaviour defined by an exception rule, the comparing indicates that the user activity is consistent with the digital behaviour profile and the digital security system is regulated to be in an operating state wherein the digital security system will automatically implement the intermediate-security-level access protocol when said user requests access to the resource in the future. the multi-level security protocol comprises an intermediate-security-level access protocol, when the comparing indicates that the user activity departs from the digital behaviour profile,, a set of one or more exception rules is applied to calculate whether or not the user activity conforms to acceptable behaviour, and when the calculation determines that the user activity conforms to acceptable behaviour defined by an exception rule, the comparing indicates that the user activity is consistent with the digital behaviour profile and the digital security system is regulated to be in an operating state wherein the digital security system will automatically implement the intermediate-security-level access protocol when said user requests access to the resource in the future.