Security action based on communication-based analysis

A method implemented by a computing system, the method comprising:

• detecting a security event triggered by an operation that is performed by a user in an organization;
• generating a first security analysis result by determining whether a communication history of the user comprises at least one of a first communication from the user that initiates an interaction with another user in the organization or a second communication that is addressed specifically to the user from another user in the organization;
• generating a second security analysis result by determining whether the communication history of the user comprises a third communication from the user that references the operation;
• causing an artificial intelligence (AI) model to generate a third security analysis result by determining whether the communication history of the user comprises a fourth communication that provides an explanation of a purpose of the operation that satisfies an explanation criterion;
• and
• in response to the security event, triggering execution of an instruction, which causes a security action to be performed with regard to the operation by selecting the security action from a plurality of security actions as a result of a combination of the first, second, and third security analysis results satisfying a security criterion.

A computer program product comprising a computer-readable storage medium having instructions recorded thereon for enabling a processor-based system to perform operations, the operations comprising:

• generating a first security analysis result by determining whether a communication history of a user in an organization who performs an operation that triggers a security event comprises at least one of a first communication from the user that initiates an interaction with another user in the organization or a second communication that is addressed specifically to the user from another user in the organization;
• generating a second security analysis result by determining whether the communication history of the user comprises a third communication from the user that references the operation;
• generating a third security analysis result, which comprises determining whether the communication history of the user comprises a fourth communication that provides an explanation of a purpose of the operation that satisfies an explanation criterion, using an artificial intelligence (AI) model by causing the AI model to analyze content of the fourth communication in context of the explanation criterion;
• and
• in response to the security event, triggering execution of an instruction, which causes a security action to be performed with regard to the operation as a result of a combination of the first, second, and third security analysis results satisfying a security criterion.