One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:
- receive, via the communication interface, from enterprise electronic communications infrastructure, communications data identifying a plurality of electronic messages sent by a plurality of enterprise users;
- identify a subset of the communications data received from the enterprise electronic communications infrastructure as being sent by a first enterprise user of the plurality of enterprise users;
- apply a grounded theory model to the subset of the communications data identified as being sent by the first enterprise user of the plurality of enterprise users, wherein applying the grounded theory model to the subset of the communications data identified as being sent by the first enterprise user of the plurality of enterprise users produces a set of psycholinguistic parameter sub-scores for the first enterprise user of the plurality of enterprise users;
- map the set of psycholinguistic parameter sub-scores for the first enterprise user of the plurality of enterprise users onto a plurality of predefined character traits, wherein mapping the set of psycholinguistic parameter sub-scores for the first enterprise user of the plurality of enterprise users onto the plurality of predefined character traits produces a user-specific character trait set for the first enterprise user of the plurality of enterprise users;
- match the user-specific character trait set for the first enterprise user of the plurality of enterprise users against a plurality of predefined high risk character trait sets to set a user-specific risk identifier for the first enterprise user of the plurality of enterprise users;
- process subsets of the communications data received from the enterprise electronic communications infrastructure to set user-specific risk identifiers for other enterprise users of the plurality of enterprise users different from the first enterprise user of the plurality of enterprise users;
- apply an anomaly density evaluation to the user-specific risk identifier for the first enterprise user of the plurality of enterprise users and the user-specific risk identifiers for other enterprise users of the plurality of enterprise users different from the first enterprise user of the plurality of enterprise users, wherein applying the anomaly density evaluation to the user-specific risk identifier for the first enterprise user of the plurality of enterprise users and the user-specific risk identifiers for other enterprise users of the plurality of enterprise users different from the first enterprise user of the plurality of enterprise users produces a dataset comprising a prioritized list of high risk enterprise users;
- send, via the communication interface, to an administrator computing device, the dataset comprising the prioritized list of high risk enterprise users;
- after sending the dataset comprising the prioritized list of high risk enterprise users to the administrator computing device, monitor, in real-time, communications sent by one or more high risk enterprise users selected from the dataset comprising the prioritized list of high risk enterprise users;
- based on monitoring the communications sent by the one or more high risk enterprise users selected from the dataset comprising the prioritized list of high risk enterprise users, generate one or more alerts;
- and
- send, via the communication interface, to the administrator computing device, the one or more alerts.