Patent ID: 8745732

Claim:
A non-transitory computer-readable medium comprising computer-executable instructions that when executed by a processor cause the processor to perform: detecting activities associated with a plurality of user accounts within a business entity and involving a plurality of control groups, wherein each user account is associated with a different individual of the business entity, wherein the plurality of user accounts comprises a first user account and a second user account, and wherein at least one of the control groups comprises a plurality of targeted communication controls; for at least the first and the second user accounts, determining that a threshold quantity of activities violated at least two controls in the control groups comprising: detecting that the first and the second user account accessed a first storage device; determining that the first user account does not have permission rights to conduct the access to the first storage device, and in response, determining that an activity violation for a first control of the at least two controls has occurred and storing an attribute value of the violation; determining that the second user account does have permission rights to conduct the access, and in response, determining that an authorized access occurred and storing an attribute value of the access; and responsive to determining that the threshold quantity of activities violated the at least two controls in the control groups, and responsive to determining that an activity violation has occurred, calculating a predictive threat rating for the first user account using the stored attribute value of the violation.