Scalable network security with fast response protocol

A method of processing security event data, implemented on at least one computer of a first network, the method comprising:

• receiving a query from a query source, the query specifying an indicator of a possible network security threat;
• accessing a local database and process content of the local database to identify whether the local database contains data corresponding to the possible network security threat;
• determining a threat level associated with the possible network security threat;
• if threat level is not greater than a threshold, transmitting a query from the at least one computer of the first network to at least one other computer via a wide area network (WAN), obtaining results from the at least one other computer, updating the threat level associated with the possible network security threat dependent on the results, and storing the updated threat level in the local database in association with the possible network security threat to thereby update the threat level in the local database;
• and if the threat level is greater than the threshold, transmitting a response to the query source responsive to data in the local database corresponding to the possible network security threat without regard to whether the whether the at least one other computer possesses additional data regarding the at least one network security threat;
• transmitting, dependent on at least one of the threat level determined by the at least one computer of the first network or the updated threat level, a remedial measure to the query source to counteract the possible network security threat;
• wherein transmitting the remedial measure is performed in a manner to cause a machine of the query source to automatically instantiate a policy to counteract the possible network security threat.