Disclosed are various embodiments for detecting unexpected behavior. A path associated with a user is tracked. It is determined whether the path corresponds to at least one intent grouping that in turn corresponds to an expected behavior. Unexpected behavior is identified when the path does not correspond to at least one intent grouping.