1. A method, operable on a server, for differential message security policies comprising: receiving, by the server, information regarding activities of a user; determining, by the server, a security risk for the user based on the activities of the user; and setting, by the server, a security policy for the user based on the security risk.