Scoring confidence in user compliance with an organization's security policies

A tangible non-transitory computer readable storage medium, including program instructions loaded into memory that, when executed on processors, cause the processors to carry out actions directed to evaluating user compliance with an organization's security policies, the action including:

• generating sequence alerts using a proxy to detect activity by users that the organization's security policies deem risky, the sequence alerts categorized by severity;
• generating batch alerts when anomalous user behaviors are detected based on deviations from historical user behavior patterns of a peer group of users, the batch alerts categorized by severity;
• scoring user confidence or user risk scores, collectively referred to as the user confidence score, by repeatedly summing alert weights, applied by category of severity, and generated over time from the sequence alerts and the batch alerts,
• wherein the alert weights over time are subject to a decay factor that attenuates the alert weights as time passes;
• and
• reporting the user confidence score, comprising causing display of
• a time series of the user confidence scores over a predetermined time and/or
• a current user confidence score and/or
• at least some details of the activity by the user that contributed to the alert weights over time.

A device for evaluating user compliance with an organization's security policies, the device including a processor, memory coupled to the processor, and computer instructions loaded into the memory that, when executed, cause the processor to carry out actions directed to evaluating user compliance with an organization's security policies, the action including:

• generating sequence alerts using a proxy to detect activity by users that the organization's security policies deem risky, the sequence alerts categorized by severity;
• generating batch alerts when anomalous user behaviors are detected based on deviations from historical user behavior patterns of a peer group of users, the batch alerts categorized by severity;
• scoring user confidence or user risk scores, collectively referred to as the user confidence score, by repeatedly summing alert weights, applied by category of severity, and generated over time from the sequence alerts and the batch alerts,
• wherein the alert weights over time are subject to a decay factor that attenuates the alert weights as time passes;
• and
• reporting the user confidence score, comprising causing display of
• a time series of the user confidence scores over a predetermined time and/or
• a current user confidence score and/or
• at least some details of the activity by the user that contributed to the alert weights over time.