1. A computer-implemented method comprising: calculating, by a computing device having a processor, a threat score for a plurality of user accounts having access to a first network and at least a portion of the user accounts having access to a second network that comprises a centralized store of electronic data, comprising, for each user account determining, by the computing device, an overall threat score (f overall ), where f overall = ( f live + f analytic ) * f person 100 , wherein f live includes calculation of data from a first time period and is calculated, by the computing device, for a plurality of activities, wherein for each activity: - f live = ∑ x = 0 n ⁢ ⁢ x greaterThan ⁢ ⁢ 0 ( weight x live 2 ) + ( hit x max hit x ) ⁢ ( weight x live 2 ) , where x specifies a predefined activity selected from a plurality of activities, and x greaterThan ⁢ ⁢ 0 = { 1 , hits x > 0 0 , hits x = 0 ⁢ wherein f analytic includes the calculation of data from a second time period and is calculated, by the computing device, for the plurality of activities of f live , wherein: 
 f analytic =(spike x +aboveAvg x +offHours x )*(weight x analytic ) wherein spike x is assigned, by the computing device, a zero value unless the user account comprises an activity level during the first time period that is over a first threshold level above an average of the same user account during the second time period and a first integer if the user account comprises an activity level during the first time period that is over the first threshold level above the average of the same user account during the second time period; wherein aboveavg x is assigned, by the computing device, a zero unless the user account comprises an activity level that is over a first threshold level above an average of a plurality of user accounts for the same time period and a first integer if the user account comprises an activity level that is over a first threshold level above an average of a plurality of user accounts for the same time period; wherein offhours x is assigned, by the computing device, a zero unless the user account comprises an activity level during a time frame during the first time period before or after the average start or end time for that user account and a first integer if the user account comprises an activity level during a time frame during the first time period before or after the average start or end time for that user account; wherein f person is a variable that considers one or more weights given to the user account; and wherein weight x live is a weighting value used for activities during the first time period and weight x analytic is a weighting value used for activities during the second time period; ranking the plurality of user accounts based on the calculated threat score; and displaying the ranking of the plurality of user accounts.