Techniques for determining behavior of individual users or multiple users of an email system with regard to Internet services are disclosed. Such techniques may include a discrete analysis that includes determining whether an email relates to use, by a user of the email system, of an Internet service established with an email address of the user. Indications of Internet service activity of users of the email system can be written to a data store. By employing these techniques across all emails of an entity, insight may be gained into the aggregate nature of Internet services being used. A policy engine may take a corrective action for the email based on the discrete analysis. An aggregate analysis may be used to update the data store, wherein the aggregate analysis includes identification of an aggregate set of Internet services for a group of users.