1. A method, implemented by one or more servers associated with a cloud-based security system, for determining security risks of entities comprising users or groups of users associated with the cloud-based security system and optimizing remediation based thereon, the method comprising: maintaining logs of transactions through the cloud-based security system; obtaining a plurality of attributes from the transactions while excluding impossible comparison items from the transactions; performing empirical scoring on normalizing the plurality of attributes for ranking risky entities; identifying the risky entities based on one of the empirical scoring and analytics; and updating policies and/or monitoring in the cloud-based system based on the identifying.