Techniques for trend extraction from unbalanced panel data
I would add a third column called month and then concatenate each list. So if you have a top 100 list for 5 months you will create one big table with 500 entries:

User-id | Threat_score | month
aaa       45             1
bbb       32             1
ccc       20             1
...       ...            ...
bbb       64             2
ccc       29             2
...       ...            ...


Then, to answer your first question, you could simply count the occurrences of each user-id. For example, if user bbb is in your concatenated table five times, then you know that person made your list all five months.

To answer you second question, you could do a group by operation to compute some aggregate function of the users. A group by operation with an average function is a little crude and sensitive to outliers, but it would probably get you close to what you are looking for.

One possibility for the third question is to compute the difference in threat score between month n-1 and month n. That is, for each month (not including the first month) you subtract the user's previous threat score from the current threat score. You can make this a new column so your table would now look like:

User-id | Threat_score | month | difference
aaa       45             1       null
bbb       32             1       null
ccc       20             1       null
...       ...            ...     ...
bbb       64             2       32
ccc       29             2       9
...       ...            ...


With this table, you could again do a group by operation to find people who consistently have a higher threat score than the previous month or you could simply find people with a large difference between the current month and the previous month.

As you suggest, visualizing this data is a really good idea. If you care about these threat scores over time (which I think you do), I strongly recommend a simple line chart, with month on the x-axis and threat score on the y-axis. It's not fancy, but it's extremely easy to interpret and should give you useful information about the trends.

Most of this stuff (not the visualization) can be done in SQL and all of it can be done in R or Python (and many other languages). Good luck!