Generally discussed herein are devices, systems, and methods for computer or other network device security. A method can include providing an alert to a device of a first cloud user in response to determining an operation performed on a cloud resource is inconsistent with a behavior profile that defines normal operation of the cloud resource, receiving feedback from the first cloud user regarding the alert, and generating, for a second, different cloud user and by prioritizing a second alert based on the feedback from the first cloud user, a second alert.