Embodiments provide systems and methods for identifying and mitigating outlier network activity. In embodiments, network activity by a plurality of users may be monitored and, based on the monitoring, a plurality of data sets may be compiled. Each of the plurality data sets may include information representative of activity by the plurality of users. A network model representative of at least a portion of the network activity may be constructed based on one or more of the plurality of data sets. The network model may be evaluated against a set of rules to produce outputs that include at least one of: a set of classifications, a set of link metrics, and a set of communities. Decision engine logic may be executed against the outputs to identify outlier network activity. In response to identifying outlier network activity, operations to mitigate the identified outlier network activity may be executed.