Abstract: A method of detecting computer security threats. A first step involves providing a reference database of selected parameters to be monitored relating to one of human behaviour when operating a computer or software behaviour during operation of a computer. A second step involves monitoring one of human behaviour or software behaviour originating from a selected computer over a time interval. A third step involves comparing the monitored behaviours to the selected parameters in the reference database and determining the presence or absence of a potential security threat from such comparison.