Deriving and surfacing insights regarding security threats

A method, comprising:

• establishing, via an application programming interface, a connection with a storage medium that includes a series of communications received by an employee of an enterprise and obtaining an email that is addressed to the employee;
• determining a plurality of features associated with the obtained email;
• using a plurality of facet models to analyze the determined features, wherein at least one facet model included in the plurality of facet models is a topic model that identifies a topic that is mentioned either directly or indirectly in the email;
• determining, based at least in part on the analysis, that the email poses a security threat;
• determining a prioritized set of information to provide as output in a report, wherein the prioritized set of information is representative of why the email was determined to pose a security threat;
• and
• providing at least a portion of the prioritized set of information as output in an interface.

A computer program product embodied in a non-transitory tangible computer readable storage medium and comprising computer instructions for:

• establishing, via an application programming interface, a connection with a storage medium that includes a series of communications received by an employee of an enterprise and obtaining an email that is addressed to the employee;
• determining a plurality of features associated with the obtained email;
• using a plurality of facet models to analyze the determined features, wherein at least one facet model included in the plurality of facet models is a topic model that identifies a topic that is mentioned either directly or indirectly in the email;
• determining, based at least in part on the analysis, that the email poses a security threat;
• determining a prioritized set of information to provide as output in a report, wherein the prioritized set of information is representative of why the email was determined to pose a security threat;
• and
• providing at least a portion of the prioritized set of information as output in an interface.