Systems and methods for adaptive action with distributed enforcement points

A system comprising:

• at least one processor and a transceiver configured to:
• receive a first dataset from a first agent of a first device intermediary between a first plurality of client devices and a first plurality of servers, the first dataset comprising a subset of data tracked at the first device and available to the first agent;
• receive a second dataset from a second agent of a second device intermediary between a second plurality of client devices and a second plurality of servers, the second plurality of client devices and the second plurality of servers being distinct from the first plurality of client devices and the first plurality of servers, the second dataset comprising a subset of data tracked at the second device and available to the second agent;
• identify a security threat indicated in the first data set or the second data set;
• send a communication to the first device and the second device, the communication comprising an instruction to mitigate the security threat;
• initiate a first action on the first device to mitigate the security threat based on a type of the first device;
• and
• initiate a second action on the second device to mitigate the security threat based on a type of the second device;
• wherein the type of the first device is different than the type of the second device and the first action on the first device is different than the second action on the second device.

A non-transitory computer-readable medium storing

• instructions that, when executed by at least one processor, cause the at least one processor to:
• receive, via a transceiver, a first dataset from a first agent of a first device intermediary between a first plurality of client devices and a first plurality of servers, the first dataset comprising a subset of data tracked at the first device and available to the first agent;
• receive, via the transceiver, a second dataset from a second agent of a second device intermediary between a second plurality of client devices and a second plurality of servers, the second plurality of device devices and the second plurality of servers being distinct from the first plurality of client devices and the first plurality of servers, the second dataset comprising a subset of data tracked at the second device and available to the second agent;
• and
• identify a security threat indicated in the first data set or the second data set;
• send, via the transmitter, a communication to the first device and the second device, the communication comprising an instruction to mitigate the security threat;
• initiate a first action on the first device to mitigate the security threat based on a type of the first device;
• and
• initiate a second action on the second device to mitigate the security threat based on a type of the second device;
• wherein the type of the first device is different than the type of the second device and the first action on the first device is different than the second action on the second device.