1. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to: identify a predetermined particular behavioral profile associated with at least one particular user of a computing system, the particular behavioral profile identifying expected behavior of users within a set of one or more users within the computing system, wherein the particular behavioral profile is based on previously detected activities of at least one user in the set and the set comprises the particular user; identify, using at least one computer processing device, activities associated with use of the computing system by the particular user; and determined, for each of the identified activities, whether the activity correlates with the particular behavioral profile, wherein determining that the activity deviates from the particular behavioral profile beyond a particular threshold triggers a risk event relating to the particular user and determining that the activity deviates from the particular behavioral profile within the particular threshold causes the particular behavioral profile to be revised based at least in part on the particular activity.