Autonomous alerting based on defined categorizations for network space and network boundary changes

A non-transitory computer-readable medium with instructed stored thereon that, when executed by a processor, cause the processor to perform operations comprising:

• scanning for each open port that are publicly accessible along a boundary of a network;
• establishing, based on said scanning, a statistical baseline for open port activity of the network;
• performing a targeted scan of at least one open port accessible along the boundary of the network;
• comparing a result of the targeted scan to the statistical baseline;
• determining that the result of the targeted scan deviates from the statistical baseline by at least a predetermined amount;
• and
• generating an alert that specifies the network has experienced a change in the open port activity.

An electronic device comprising:

• a memory that includes instructions for discovering events that alter a boundary of a first network,
• wherein the instructions, when executed by a processor, cause the processor to:
• establish the boundary of the first network by identifying each Internet Protocol (IP) address on the first network that is presently capable of connecting to a second network;
• continually monitor the boundary of the first network;
• determine that an event occurred that altered the boundary of the first network;
• and
• autonomously address a heightened security risk resulting from the event.