1. A computer implemented method, comprising: performing operations as follows on at least one processor: calculating a network activity score that corresponds to a network usage pattern for each network user of a plurality of network users; assigning one network user of the plurality of network users into a first risk class of a plurality of risk classes responsive to the network activity score of the one network user; and selecting a first subsequent action based on the first risk class to which the one network user is assigned, wherein the plurality of risk classes include at least the first risk class, a second risk class and a third risk class, wherein the plurality of network users include a first network user, a second network user and a third network user, and wherein the second risk class is associated with a second subsequent action and the third risk class is associated with a third subsequent action, the method further comprising assigning the second network user to the second risk class responsive to the network activity score of the second network user, selecting the second subsequent action based on the second risk class to which the second network user is assigned, assigning the third network user to the third risk class responsive to the network activity score of the third network user, and selecting the third subsequent action based on the third risk class to which the third network user is assigned; wherein calculating the network activity score comprises estimating network flow data corresponding to each one of the plurality of network users; wherein estimating the network flow data comprises: estimating bandwidth utilization of each one of the plurality of network users; and estimating high-risk-access data corresponding to communications between each one of the plurality of network users and high-risk network sources; wherein assigning the second network user to the second risk class responsive to the network activity score of the second network user comprises assigning the second network user to a subscriber surveillance class, and wherein selecting the second subsequent action based on the second risk class to which the second network user is assigned comprises: gathering evidence of high-risk network activity; and adjusting the network activity score of the second network user responsive to gathering evidence of high-risk network activity; wherein gathering the evidence of high-risk network activity comprises: redirecting network traffic of the network user to a security node that is operable to analyze network activity of the network user via deep packet inspection.