1. A non-transitory computer-readable medium comprising computer-executable instructions that when executed by a processor perform a method comprising: for each of a plurality of users, calculating a baseline activity score, comprising: determining values of controls for electronic transmissions associated with the user over a first time period, wherein the controls comprise: a bandwidth control relating to a quantity of bandwidth associated with the user over a first network during the first time period; a blocked transmission control relating to blocked transmissions associated with the user over the first network during the first time period; a non-blocked transmission control relating to non-blocked transmissions associated with the user over the first network during the first time period that violate at least one predefined criterion; and calculating the baseline activity score based upon the values of the controls over the first time period; for each of a plurality of users, calculating a second activity score, including: determining values of the controls for electronic transmissions associated with a second time period; and calculating a second activity score based upon the values of the controls over the second time period; and for each of a plurality of users, calculating a predictive threat score, including: comparing the baseline activity score with the second activity score, wherein both of the baseline activity score and the second activity score each include sub-scores and the comparing of the baseline activity score with the second activity score includes: comparing a sub-score of the baseline activity score with a sub-score of the second activity score.