A computer-implemented method for context-based analysis of requested activity in a computing environment, the method comprising: building a plurality of dynamic context profiles (201, 301, 401, 501, 601) for a plurality of processes in the computing environment, wherein the plurality of dynamic context profiles are based on monitoring and analyzing at least: static parameters (102, 106) of the plurality of processes; dynamic parameters (103, 107) of the plurality of processes; and a detected activity (104, 108) involving the plurality of processes; receiving an indication of a current runtime activity involving at least one identity in the computing environment; matching the indication of the current runtime activity to a dynamic context profile from the plurality of built dynamic context profiles, wherein the matching comprises: analyzing previous steps of a process associated with the current runtime activity; and identifying, based on the previous steps, an automated action or a human action associated with at least one of the current runtime activity and the process; determining, based on the matching, a context-based probability that the current runtime activity is at least one of: an anomalous activity, a suspicious activity, or non-valid with respect to the dynamic context profile; wherein the context-based probability has an associated confidence level where the confidence level increases as the number of steps in the dynamic context profile increases; and performing a control action in association with either the current runtime activity or the process based on whether the current runtime activity is determined to be at least one of: an anomalous activity, a suspicious activity, or non-valid. building a plurality of dynamic context profiles (201, 301, 401, 501, 601) for a plurality of processes in the computing environment, wherein the plurality of dynamic context profiles are based on monitoring and analyzing at least: static parameters (102, 106) of the plurality of processes; dynamic parameters (103, 107) of the plurality of processes; and a detected activity (104, 108) involving the plurality of processes; static parameters (102, 106) of the plurality of processes; dynamic parameters (103, 107) of the plurality of processes; and a detected activity (104, 108) involving the plurality of processes; receiving an indication of a current runtime activity involving at least one identity in the computing environment; matching the indication of the current runtime activity to a dynamic context profile from the plurality of built dynamic context profiles, wherein the matching comprises: analyzing previous steps of a process associated with the current runtime activity; and identifying, based on the previous steps, an automated action or a human action associated with at least one of the current runtime activity and the process; analyzing previous steps of a process associated with the current runtime activity; and identifying, based on the previous steps, an automated action or a human action associated with at least one of the current runtime activity and the process; determining, based on the matching, a context-based probability that the current runtime activity is at least one of: an anomalous activity, a suspicious activity, or non-valid with respect to the dynamic context profile; wherein the context-based probability has an associated confidence level where the confidence level increases as the number of steps in the dynamic context profile increases; and performing a control action in association with either the current runtime activity or the process based on whether the current runtime activity is determined to be at least one of: an anomalous activity, a suspicious activity, or non-valid.