1. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to: identify that a particular one of a plurality of behavioral profiles is associated with a particular user of a computing system, wherein the particular behavioral profile identifies expected behavior for users associated with the particular behavioral profile, the particular behavioral profile is based on previously detected activities of a set of one or more users, and the set of users comprises the particular user; interpret data to identify one or more detected activities of the particular user involving the computing system as detected by a plurality of security tools to provide security services to the computing system; determine that at least a particular one of the detected activities deviates from the particular behavioral profile beyond a particular threshold; trigger a risk event related to the particular detected activity; and revise the particular behavioral profile based on the detected activity.