Users start with a baseline risk score of 1,000. When they attempt to access applications or download data, the system flags deviations from normal patterns, allowing security teams to investigate specific user behaviors and potential security risks.