1. A system configured to generate a risk score for a threat activity comprising: a digital device configured to: extract one or more threat events on a network based on metadata for one or more targeted digital devices on said network; detect one or more incidents based on a correlation between at least a first threat event of said one or more threat events and a second threat event of said one or more threat events; and generate a risk score for each of said one or more incidents.