In some embodiments, communications in a private network are programmatically inspected to identify traffic associated with uncontrolled Web applications originating from outside of the private network. Unstructured data, including messages and application content, originating from such uncontrolled Web Applications may be disassembled, analyzed, and categorized into source specific application element types (AETs). A monitoring layer may be injected on a page associated with the uncontrolled Web Application to allow a user to switch between different modes. Activities associated with different modes may be handled differently utilizing AETs. Example modes may include personal, professional, etc. The monitoring layer provides an entity operating a private network with the ability to distinguish different types of user activities associated with accessing uncontrolled Web applications, allowing the entity to isolate those activities and contents that should be monitored and process them according to internal policies and/or business rules.