An important unsolved problem in computer security is that of detecting when an account has been hijacked and the person using the account is not the authorized user. We describe a data set consisting of the titles of windows used by users, and discuss methods for visualizing the user's session as it progresses. Intersection graphs are used to relate the current session to past sessions by the user, and the evolution of the graphs are used as a "profile" for the user.