Preventing unauthorized access to corporate information systems is essential for many organizations. To address this problem we built a security enhancement software system using software agents, in which a core software agent resides on a server and user end software agents reside at each user workstation. By downloading a pattern of typical user behavior and rules governing invalid behavior from a core agent to each user end agent, all decisions and actions about atypical or invalid user behavior can be taken by a user agent. This permits security detection to continue even when the core agent fails to operate.