1. A non-transitory computer-readable medium storing computer-executable instructions that when executed by a processor cause the processor to perform: calculating a ranking of a plurality of user accounts within an organization that represent a threat to the organization, wherein the ranking is determined by a predictive threat score for each user account of the plurality of user accounts, wherein the predictive threat score is based on a comparison of a first set of values of at least four controls that are monitored over a first time period to a second set of values of the at least four controls that are monitored over a second time period, and wherein the values of the first set of values and the second set of values for each user account are selected from the group consisting of: a value corresponding to a quantity of bandwidth utilized by the user account over a network; a value corresponding to a number of blocked transmissions by the user account over the network; a value corresponding to a number of blocked communications through a targeted communication application, the targeted communication application allowing a first user to communicate directly with another individual; a value corresponding to a number of non-blocked communications through the targeted communication application that violate at least one predefined criterion; a value indicating whether at least one security application is associated with the user account; a value indicating an illegal storage attempt; and a value indicating whether a communication has been transmitted or received through the network via an unauthorized protocol; wherein monitoring the at least four controls further includes: assigning, by the processor, a zero value to an activity characteristic unless it is determined that an activity level of a first user account is over a first threshold level above an average of the plurality of user accounts for a same time period and a first integer to the activity characteristic if it is determined that the activity level of the first user account is over the first threshold level above an average of the plurality of user accounts for the same time period; and transmitting electronic signals configured to display the ranking of the plurality of user accounts.