System security evaluation

A computing device, comprising:

• a memory to store instructions;
• and
• a processor, connected to the memory, to execute the instructions to:
• receive external activity data corresponding to a target system,
• where the external activity data comprises information
• corresponding to network-side information relating to the target system,
• identify suspicious external activity, corresponding to the external activity data, based on an activity watchlist,
• where the activity watchlist comprises information corresponding to external activity systems associated with known sources of malicious activity;
• identify suspicious external activity, corresponding to the external activity data, based on a security evaluation mechanism,
• where the security evaluation mechanism comprises an operation to identify a suspicious characteristic corresponding to the external activity data;
• and
• generate a system security report based on the suspicious external activity identified.

One or more non-transitory computer-readable storage media, comprising:

• one or more instructions that, when executed by a processor, cause the processor to:
• detect a potential system vulnerability corresponding to a target system,
• verify that the potential system vulnerability comprises an actual system vulnerability,
• receive external activity data corresponding to the target system,
• where the external activity data comprises information
• corresponding to network-side information relating to the target system,
• identify suspicious external activity, corresponding to the external activity data, based on an activity watchlist,
• where the activity watchlist comprises information corresponding to external activity systems associated with known sources of malicious activity;
• identify suspicious external activity, corresponding to the external activity data, based on a security evaluation mechanism,
• where the security evaluation mechanism comprises an operation to identify a suspicious characteristic corresponding to the external activity data;
• and
• generate a system security report based on the suspicious external activity identified.