Intelligent security management

A computer-implemented method, comprising:

• training a neural network using historical activity with respect to a plurality of documents stored, on behalf of an entity, in an electronic resource environment;
• determining, using the neural network, an expected activity of a specified user with respect to the plurality of documents over at least one determined period time;
• detecting user activity, over at least a determined period of time, with respect to at least a specified document of the plurality of documents, the user activity associated with the specified user;
• determining at least one topic associated with the specified document;
• comparing the at least one topic against topics associated with the expected activity;
• processing the user activity using the neural network to determine whether the user activity deviates from the expected type of activity, the determination based at least in part upon a topic distance, in a topic vector space, between the at least one topic and the topics associated with the expected activity;
• and
• performing a determined action if the user activity is determined to deviate unacceptably from the expected type of activity.

A system, comprising:

• at least one processor;
• and
• memory including instructions that, when executed by the at least one processor, cause the system to:
• train a topic model using a set of training documents, each training document of the set having at least one identified topic and an assigned risk score;
• crawl a plurality of documents, stored for an entity across an electronic resource environment, to locate and index the plurality of documents;
• determine, using at least the topic model, one or more topics for each document of the plurality of documents;
• determine a risk score for each document of the plurality of documents using a trained random forest regressor;
• and
• provide security information for access by an authorized user associated with the entity, the security information including information for the identified topics and risk scores for the plurality of documents stored for the entity.