Abstract: Embodiments of the present disclosure provide enhanced threat relevancy identification user affinity of users within a security system. Security-related training data within a security system including indicators of compromise (IoC), security observables, and artifacts are evaluated and enriched to provide training data enrichment results for features collection. Clusters of users are created based on similarity of training data enrichment results between users. A risk posture of a cluster of users is determined based on relevancy of a risk detected by a user in the user cluster.