As users work throughout the day, they are constantly using their input devices—their keyboard and their mouse or other pointer hardware. Plurilock DEFEND uses the movement patterns that users exhibit as they compute to confirm or reject identity. When a user's observed movement patterns match the user's previous normal behavior, no risk is reported. When DEFEND assesses a user’s input movements to be unusual, however, it begins to log risk. If a configurable threshold is crossed, DEFEND instantly alert security staff to the presence of an identity threat.