Cyber security for instant messaging across platforms

A non-transitory computer readable medium comprising computer readable code operable, when executed by one or more processing apparatuses in a cyber threat defense system to instruct a computing device to perform operations comprising:

• collecting, from one or more network entities that utilize one or more instant messaging platforms, instant messaging data describing an instant message and associated with a user account on at least a first instant messaging platform, wherein the instant messaging data is collected into one or more instant message modules and the collecting of the instant message data is conducted by at least (i) gathering a messaging archive for a client system using a web hook authorized by the instant messaging platform and (ii) translating the instant messaging data into a universal format;
• generating a composite user profile from user context data collected across multiple platforms of the client system, where the composite user profile for the multiple platforms of the client system factors in data from i) the instant messaging platform and ii) at least one of a System-as-a-Service (SaaS) platform, a cloud platform, an information technology network, and an email platform, associated with the user;
• identifying a user of the client system associated with the user account based on the composite user profile and contextualizing the instant messaging data under analysis with at least a portion of the user context data;
• associating the user with a user risk profile based on the composite user profile, wherein the composite user profile is based on a combination of (i) a user importance score that identifies at least a number of services and resource that the user can affect and (ii) a vulnerability score directed to a determination of vulnerabilities based on analysis of the instant message data by one or more artificial intelligence classifiers to calculate a degree of damage attributable to the user in response to the cyber threat;
• and
• performing an autonomous response to the cyber threat by an autonomous response module interacting with the one or more instant messaging modules, the autonomous response is based, at least in part, on the user risk profile.