Managing computer security services for cloud computing platforms

One or more non-transitory computer-readable storage media storing sequences of instructions which when executed cause one or more hardware processors to perform a method of managing security services for a cloud computing platform, the method comprising:

• receiving, by a security gateway system, a digital communication related to one of one or more computing applications hosted by a virtual cluster for private use by a client device on a cloud computing platform,
• the security gateway system residing within the cloud computing platform,
• the security gateway system performing network security gateway functions for the one or more computing applications hosted by the virtual cluster;
• storing the digital communication in association with a timestamp in a storage device,
• wherein the timestamp indicates when the digital communication was received;
• receiving one or more pieces of threat intelligence data indicating a security threat from a main controller residing outside the virtual cluster;
• storing the one or more pieces of threat intelligence data in a database;
• determining whether any of the one or more pieces of threat intelligence data in the database applies to any of digital communications in the storage device, comprising:
• determining whether the digital communication matches any of the one or more pieces of threat intelligence data in the database;
• in response to determining that the digital communication matches a certain piece of threat intelligence data in the database, cleaning up or discarding the digital communication;
• in response to determining that the digital communication matches no piece of threat intelligence data in the database, sending application-level data of the digital communication to a destination of the digital communication;
• transmitting an estimate of an extent or timing of an impact of the security threat based on the determining, comprising sending information regarding a security harm associated with a specific piece of threat intelligence data and information including a date of receipt regarding digital communications matched to the specific piece of threat intelligence data to the client device.