A device that is configured to receive user activity information that includes information about user interactions with a network device for a plurality of users. The device is further configured to receive a set of bad actor candidates that identifies one or more users from among the plurality of users. The device is further configured to filter the user activity information based on the set of bad actor candidates. The device is further configured to input the filtered user activity information into a machine learning model. The machine learning model is configured to receive the filtered user activity information and to output system exposure information that identifies network security threats. The device is further configured to identify network security actions based on the network security threats and to execute the network security actions.