1. A non-transitory computer-readable medium embodying a program that, when executed in at least one computing device, causes the at least one computing device to at least: generate a plurality of stored behavioral events associated with a user identity based at least in part on an action of a user at a client device, the action comprising a predefined sequence of behavioral events; in response to receiving an assertion of the user identity, monitor a plurality of behavioral events expressed by the client device relative to a plurality of resources of a first network site; perform a comparison between the plurality of behavioral events and the plurality of stored behavioral events; determine an inverse identity confidence score as to whether the user identity does not belong to the user at the client device based at least in part on the comparison; and authenticate the user at the client device to access a resource of a second network site based at least in part on determining that the inverse identity confidence score does not meet a threshold.