A method and system for determining a risk of a cybersecurity event related to a user. Initial user-related data associated with user interactions are collected, comprising user-device, user-network and user-resource interaction data. A unique user profile is determined and defines the digital identity of the user based on the initial user-related data. A first risk processing engine collects, in real time and repeatedly, a real-time user-related data associated with real-time user interactions and detects an anomaly in user's behavior based on the collected real-time user-related data and the digital identity of the user. A second risk processing engine collects complementary data associated with the user (dark web or digital exposure data) to determine a risk profile of the user, and determines the risk of the cybersecurity event based on the anomaly in the user's behavior and the complementary data, in real-time over a complete period of use of resources.