A process for managing usage on a broadband network, said process comprising: (a) monitoring a subscriber's broadband usage; (b) determining if said usage rises to a level indicative of an event; (c) determining if said event is consistent with heavy usage or with a security incident; (d) if said event is consistent with heavy usage, offering said subscriber at least one of a plan for an upgraded subscription, or an incentive to concentrate usage in nonpeak time; and (e) if said event is consistent with a security incident, exercising security measures to minimize unintended usage.