A database activity monitoring service, operating independent of a database server, in response to intercepting a database server response issued by the database server comprising a result set associated with a dynamic database query, extracts a first selection of data from the result set, the first selection of data identifying one or more dynamic query elements of the dynamic database query as constructed by the database server at runtime. The database activity monitoring service determines whether the one or more dynamic query elements comply with one or more security policies. The database activity monitoring service, in response to determining that the one or more dynamic query elements fail to comply with at least one of the one or more security policies, issues a security alert.