Abstract: A computer system is protected against harmful activity of a privileged user. A risk agent is deployed which is communicatively coupled to a risk engine, the risk engine being operative in response to queries to perform model-based risk assessments of activities and to provide responses conveying risk assessment results. The risk agent monitors computer system activity of the privileged user to detect initiation of a sensitive operation, and formulates and sends a query to the risk engine requesting risk assessment. The risk agent takes an appropriate control action based on a risk assessment result in a response to a query. The control action may be one of allowing the sensitive operation to proceed; preventing the sensitive operation from proceeding; issuing a notification that the sensitive computer operation is proceeding; and obtaining further confirmation as a condition to allowing the sensitive operation to proceed.