Abstract: In one aspect, an example computer-implemented method includes (a) receiving, from a client computing platform, a first plurality of time-indexed data packets indicative of user activity associated with a user of the client computing platform; (b) receiving, from the client computing platform, a second plurality of time-indexed data packets indicative of one or more anomalies at the client computing platform; (c) comparing the first and second plurality of time-indexed data packets to determine whether a particular anomaly caused a change in user intent of the user to perform a particular activity at the client computing platform; (d) based upon a determination that the particular anomaly caused the change in user intent, determining, for the particular anomaly, an estimated loss of a client resource at the client computing platform; and (e) displaying, by a graphical user interface, a graphical representation of the particular anomaly and the estimated loss.