A cognitive security service receives, as input to a recurrent neural network, a matrix of regular locations and usage for a user at multiple times as reported by one or more mobile devices for the user via a network. The cognitive security service applies the matrix in the recurrent neural network to predict one or more next device locations for a next step in time, each of the one or more next device locations weighted with a separate probability. The cognitive security service generates, through the recurrent neural network, an alert in response to one or more selected location and selected usage weighted with the highest probability deviating from a current location of the one or more mobile devices beyond a threshold specified by the user.