Disclosed are systems, methods and computer program products for classifying users of antivirus software based on user's level of expertise in the field of computer security. In one example, the system receives from antivirus software deployed on a user's computer information about security of the computer and history of user's usage of the software. The system categorizes the received information into categories based on (i) a number of computer threats detected by the user, (ii) a frequency of malware infections of the user's computer, and (iii) a level of user's proficiency with the antivirus software. The system then selects condition-action rules for each category of information and applies the selected rules to the categorized information to determine user's level of expertise in computer security. Finally, the system classifies the user as one of an expert or typical user based on the user's level of expertise.