Abstract: Systems and methods are provided for determining the security risk associated with one or more users of a computer network. Users are monitored over time to build security related profiles which are employed to assess the risk they impose on the network. The user profiles, which may be computed as online and network user profiles for each user, are processed to classify users according to user groups. A composite risk measure is generated, for a given user, based on a first measure that is obtained by processing the user profile data, and a second security risk measure, that is obtained by comparing the present user group to which the user has classified and a prior user group that was associated with the given user. Action may be taken by an administrator to mitigate the risk posed by that user based on the computed composite risk score.