1. A method for assessing the risk posed by a web user, comprising the steps of: assembling a set of risk scores associated with the web user, including capturing one or more web actions taken by the user; computing a risk score for zero or more risk criteria, including assigning the web action to zero or more risk criteria, the risk criteria having one or more associated risk calculating and weighting factor; and applying the calculating and weighting factor to obtain the risk score and using historical data from various intervals prior to a duration of the one or more web actions to provide a hysteresis effect with older data having less effect over time on the risk score; and storing the risk score together with selected information about the user and the web action; and determining a total risk score for the user over a selected time period; wherein the risk criteria is segmented between external risk categories and internal risk categories, wherein the internal risk categories are utilized to reveal gaps in coverage of the risk criteria to assist in developing new criteria for the risk criteria and the external risk categories are utilized to enforce security measures with the risk score.