1. A method comprising: defining a role for an entity; associating a plurality of users to the role in the entity; monitoring behavior information for the plurality of users; generating a profile for each user based on each users' monitored behavior; comparing information for a user's behavior with profiles of other users associated with the role; and generating a message based on the analysis, the message indicating an anomaly in the user's behavior with respect to other users' behavior within the role.