Risk-based privacy-aware access control for threat detection systems