Abstract: Security event data from each of a plurality of security data sources is received, each unit of the security event data being associated with a security event involving one or more human users included in a monitored set of human users. The security event data is used to generate for each of at least a subset of the monitored set of human users a user-specific security risk score that is determined based at least in part on: a level of access to protected resources that a user has; an attack type that has been attempted with respect to the user; and an action taken by the user, as reflected in the security event data associated with the user from two or more of said security data sources.