1. A method of operating a virtual machine (VM) server computer comprising: executing a VM instance at the VM server computer, the VM instance having a remote display within a terminal program of a remote client computer, the terminal program being configured to send commands received by the client computer from a user to the VM server computer to affect operation of the VM instance; running a web browser within the VM instance, the web browser having a connection to a secure web application running on a web application server, the commands sent from the terminal program to the VM server computer allowing the user to interact with the secure web application via the terminal program and the web browser running on the VM instance; at the VM server computer, asynchronously collecting information in connection with the commands sent from the user to the VM server computer; and at the VM server computer, asynchronously sending the collected information to an analysis server to be analyzed for anomalous behavior by the user; wherein collecting information in connection with the commands sent from the user to the VM server computer includes: receiving cursor data provided by the terminal program of the remote client computer, the cursor data indicating when and where the user clicked and hovered a cursor within the terminal program; and extracting, from the cursor data, timed user action sequences in response to the web browser displaying particular web pages, the timed user action sequences enabling the analysis server to perform bio-rhythm analysis and vitality detection analysis.