Abstract: Some embodiments operationally connect a risk score with cybersecurity protection mechanisms and user interactions data in a feedback loop. The risk score guides protection activities by the protection mechanisms, thereby prompting or preventing various user interactions. The protection activities and the user interactions are recorded in audit logs, and curated data based on the audit logs is fed to a risk scoring model as input. The risk scoring model then updates the risk score, and the loop repeats as the protection mechanisms alter their protection activities based on the updated risk score, thereby providing adaptive protection. Security tools for insider risk management, data leak prevention, and conditional access are enhanced to provide adaptive protection, by recording protection activities and user interactions for use as risk model input, and by checking regularly for risk score updates and modifying their protection activities accordingly.

Abstract: Some embodiments operationally connect a risk score with cybersecurity protection mechanisms and user interactions data in a feedback loop. The risk score guides protection activities by the protection mechanisms, thereby prompting or preventing various user interactions. The protection activities and the user interactions are recorded in audit logs, and curated data based on the audit logs is fed to a risk scoring model as input. The risk scoring model then updates the risk score, and the loop repeats as the protection mechanisms alter their protection activities based on the updated risk score, thereby providing adaptive protection. Security tools for insider risk management, data leak prevention, and conditional access are enhanced to provide adaptive protection, by recording protection activities and user interactions for use as risk model input, and by checking regularly for risk score updates and modifying their protection activities accordingly.