A method is provided. The method includes receiving information about user data and user behavior relating to a user, where the information is derived at least in part from a human resources database. The method includes applying analytics to the received information. The method includes, as a result of applying analytics to the received information, generating a threat score for the user.