Particular embodiments use roles to determine anomalies in a user's behavior. Different roles may be defined for a business. For example, users that have similar job responsibilities are grouped in a role. Behavior information is then monitored for the plurality of users in the role. This may include transactions or other actions taken by the user. Over time, a profile can be generated for the user based on the monitored behavior. This profile learns the user's behavior. Information for the user's behavior may then be compared to other users' profiles in the same role to determine anomalies in the user's behavior over time. For example, when differences in activities occur for a user as compared to other users with the same role, a message may be generated that indicates that there may be an anomaly in the user's behavior. This alert may then be output.