1. A method for user profiling for detecting insider threats, the method comprising the steps of: (a) upon a client application sending a request for a URI (Uniform Resource Identifier) web link, extracting at least one search keyword from a search session associated with said request; (b) classifying said URI web link into at least one classification; (c) determining whether said at least one classification is a monitored classification; (d) capturing search elements of search sessions associated with said monitored classification; (e) acquiring usage data from said search elements to create a user profile associated with a user's search behavior; (f) monitoring a level of sophistication of software used by said user; and (g) performing a statistical analysis, on a search frequency for said monitored classification and on said level of sophistication, on user profiles associated with many users, to yield a respective grade in knowledge/skill.