An apparatus includes a memory and a hardware processor. The memory stores a first profile and a first hash. The processor receives a first message indicating that the user has entered a building and updates the first profile to produce a second profile. The processor generates a second hash, calculates a first deviation between the second hash and the first hash, and determines that the first deviation is below a threshold. The processor receives a second message indicating that the user has requested access to a software application and updates the second profile to produce a third profile. The processor also generates a third hash, calculates a second deviation between the third hash and the first hash, determines that the second deviation is above the threshold, and in response, flags the user for increased security monitoring and denies the user access to the software application.