1. A computer-implemented method comprising: calculating a threat score for a plurality of user accounts having access to a first network and at least a portion of the user accounts having access to a second network that comprises a centralized store of electronic data, comprising, for each user account determining an overall threat score (f overall ), where f overall = ( f live + f analytic ) * f person 100 , wherein f live includes the calculation of data from a first time period and is calculated for a plurality of activities, wherein for each activity: - f live = ∑ x = 0 n x greaterThan 0 ( weight x live 2 ) + ( hit x max hit x ) ( weight x live 2 ) , where x specifies a predefined activity selected from a plurality of activities, and x greaterThan 0 = { 1 , hits x > 0 0 , hits x = 0 wherein f analytic includes the calculation of data from a second time period and is calculated for the plurality of activities of f live , wherein: 
 f analytic =(spike x +aboveAvg x +offHours x )*(weight x analytic ) wherein spike x is assigned a zero value unless the user account comprises an activity level during the first time period that is over a first threshold level above an average of the same user account during the second time period; wherein aboveavg x is assigned a zero unless the user account comprises an activity level that is over a first threshold level above an average of a plurality of user accounts for the same time period; wherein offhours x is assigned a zero unless the user account comprises an activity level during a time frame during the first time period before or after the average start or end time for that user account; and wherein f person considers one or more weights given to the user account.