A method and system for verifying a user of a computer system are presented. One example comprises observing behavioral characteristics of the user's interactions with the computer system during a current session of computer system usage, the behavioral characteristics being based on command invocation behavioral characteristics. The example further comprises identifying variations between the observed behavioral characteristics and a behavioral profile developed based on prior command invocation behavioral characteristics of the user. A verification procedure for the user to complete to continue the current session is then implemented based on the identified variations between the observed behavioral characteristics and the behavioral profile.