1. A computer system comprising: one or more hardware computer processors configured to execute computer executable instructions in order to cause the computer system to: receive information indicative of an access to a network by a user, wherein the information comprises at least an identity of a machine used by the user to access the network; and determine, based on the information, a host score indicative of a first likelihood that the user access to the network was malicious, wherein the host score is also determined based, at least in part, on a number of unique machines that the user has used to access the network.