Network-level elevated security execution modes for network-accessible devices

A non-transitory computer-readable medium with instructions stored thereon that, responsive to execution by a processing device, cause the processing device to perform operations comprising:

• monitoring activity on one or more devices, communicatively coupled as a computer network, for an active security threat;
• detecting an indication of the active security threat to at least one endpoint of a plurality of endpoints based on the monitoring, the indication of the active security threat associated with a device threat type;
• determining that the device threat type is a threat type that requires elevated security measures;
• responsive to the determining that the device threat type requires elevated security measures, updating a network-access policy for the plurality of endpoints with the threat type, wherein the updating comprises establishing a new or updated rule to limit communication between the at least one endpoint and other endpoints of the plurality of endpoints, and wherein the new or updated rule directs the other endpoints to ignore data transmitted from the at least one endpoint;
• and
• after the updating, automatically remediating the active security threat on the at least one endpoint within a first time period.

A threat management computer system to manage active security threats on an enterprise network, comprising:

• a memory with instructions stored thereon;
• a processing device, coupled to the memory, the processing device configured to access the memory and execute the instructions;
• and
• a network device coupled to the processing device and configured to update network policies for a plurality of endpoints, wherein the instructions cause the processing device to perform operations including:
• monitoring activity on one or more devices, communicatively coupled as a computer network, for an active security threat;
• detecting an indication of the active security threat to at least one endpoint of a plurality of endpoints based on the monitoring, the indication of the active security threat associated with a device threat type;
• determining that the device threat type is a threat type that requires elevated security measures;
• responsive to the determining that the device threat type requires elevated security measures, updating a network-access policy for the plurality of endpoints with the threat type, wherein the updating comprises establishing a new or updated rule to limit communication between the at least one endpoint and other endpoints of the plurality of endpoints, and wherein the new or updated rule directs the other endpoints to ignore data transmitted from the at least one endpoint;
• and
• after the updating, automatically remediating the active security threat on the at least one endpoint within a first time period.