7. One or more hardware storage devices having stored thereon computer-executable instructions, which are executable by one or more processors of a computing system to cause the computer system to: evaluate historical authentication data to identify a set of authentication context properties associated with user authentication sessions; evaluate compromised user account data to identify a set of malicious account context properties associated with at least one of compromised user accounts or compromised user authentication events; annotate the set of authentication context properties and the set of malicious account context properties to create an annotated context properties training set; train a plurality of risk assessment machine learning modules based upon the annotated context properties training set to generate a plurality of risk assessment models, wherein each risk assessment model is responsive to a predefined context property; identify a current user account event of a current user; evaluate a first current user context property of the current user using a first risk assessment model; evaluate a second current user context property of the current user using a second risk assessment model; aggregate results from the first and the second risk assessment models to generate a risk analysis metric; and moderate the current user account event based upon the risk analysis metric, wherein the current user account event is moderated by the computing system blocking the current user for a current session of the current user account event.
7. One or more hardware storage devices having stored thereon computer-executable instructions, which are executable by one or more processors of a computing system to cause the computer system to: evaluate historical authentication data to identify a set of authentication context properties associated with user authentication sessions; evaluate compromised user account data to identify a set of malicious account context properties associated with at least one of compromised user accounts or compromised user authentication events; annotate the set of authentication context properties and the set of malicious account context properties to create an annotated context properties training set; train a plurality of risk assessment machine learning modules based upon the annotated context properties training set to generate a plurality of risk assessment models, wherein each risk assessment model is responsive to a predefined context property; identify a current user account event of a current user; evaluate a first current user context property of the current user using a first risk assessment model; evaluate a second current user context property of the current user using a second risk assessment model; aggregate results from the first and the second risk assessment models to generate a risk analysis metric; and moderate the current user account event based upon the risk analysis metric, wherein the current user account event is moderated by the computing system blocking the current user for a current session of the current user account event. 10. The one or more hardware storage device of claim 7 , the annotated context properties training set is annotated in response to the computing system: evaluating the set of malicious account context properties to identify a user account context property pattern indicative of at least one of a compromised user account or a compromised user authentication event; and annotating the user account context property pattern as malicious to create a malicious user account context property pattern for inclusion within the annotated context property training set.