1. A computer system comprising: one or more hardware computer processors configured to execute computer executable instructions in order to cause the computer system to: track a number of a plurality of unique machines that a user has used to access a network, wherein the number of the plurality of unique machines is incremented when the user accesses the network from a machine that has not been previously used by the user to access the network; receive information indicative of an access to a network by a user from a new unique machine that the user has not previously used by the user to access the network, wherein the information comprises at least an identifier of the new unique machine; and determine, in response to receiving the information, a host score indicative of a first likelihood that the access to the network was malicious, wherein the host score is based, at least in part, on the number of the plurality of unique machines that the user has used to access the network.