Abstract: According to one embodiment, a computer-implemented method performed by a computing device comprising at least one processor, the method comprising determining a threat score for a user action in a computer application and calculating a decayed threat score based on the determined threat score and a damping factor. The threat score being indicative of a risk presented by the user action, the decayed threat score being a modified threat score for the user action, and the damping factor being a constant value used to reduce the determined threat score.