Systems and methods for electronically monitoring employees to determine potential risk

A method for determining whether monitored activity on a network poses a risk to an organization, the method comprising:

• electronically monitoring, by an employee monitoring/watch interface of a web application layer executed by at least one computing device, employee activities of a plurality of employees at substantially the same time;
• receiving, by an employee processing interface of the web application layer executed by the at least one computing device, subject data relating to an employee to be investigated based on an event resulting from the monitoring of the employee activities;
• receiving, by an external data layer executed by the at least one computing device, legal activity data from one or more legal databases, the legal activity data comprising information regarding legal activity relating to the employee;
• receiving, by the external data layer executed by the at least one computing device, financial activity data from one or more financial databases, the financial activity data comprising financial activity relating to the employee;
• receiving, by the employee monitoring/watch interface of the web application layer executed by the at least one computing device, electronic activity data relating to one or more activities electronically conducted by the employee on a network communicatively coupled to the at least one computing device, the electronic activity data generated in response to the electronic monitoring of an electronic device being operated by the employee on the network, the electronic activity data including data relating to operation of the electronic device by the employee;
• receiving, by the external data layer executed by the at least one computing device, social networking data from one or more social networking databases, the social networking data comprising social networking activity conducted by the employee;
• aggregating, by a microservices layer in communication with the web application layer and the external data layer and executed by the at least one computing device, the legal activity data, the financial activity data, the electronic activity data, and the social networking data into an employee profile relating to the employee;
• determining, by the microservices layer executed by the at least one computing device, legally Protected Information regarding the employee from the employee profile;
• configuring a client presentation software layer of the at least one computing device to prohibit provisioning of the legally Protected Information to a user via the client presentation software layer, wherein the client presentation software layer includes a private user interface that generates a plurality of security user interfaces for controlled access to information about the employee, each of the plurality of security user interfaces based on a class of a user desiring to access the information about the employee;
• generating, by an analytics service of the microservices layer executed by the at least one computing device, a behavior model based on at least one of the social networking data, the legal activity data, the financial activity data, and the electronic activity data, wherein the behavior model generates data associated with typical behavior for the target employee;
• determining, by the microservices layer executed by the at least one computing device, one or more anomalies associated with the employee based on the employee profile and the behavior model;
• and
• generating, by the at least one computing device, an alert relating to the one or more anomalies, wherein the alert does not contain references to the legally Protected Information.