1. A method for processing queries from a user device by a server, comprising: receiving, by the server, one or more queries from a security software of the user device directed to one or more cloud services provided by the server, wherein the security software is configured to follow different procedures for contacting one or more different cloud services; analyzing the one or more queries received from the security software to determine whether the security software followed a correct procedure for contacting the one or more services, including determining a time difference between two consecutive queries of a cloud service by the security software, and, when the time difference is shorter than a predefined time period, determining that the user device did not comply with the correct procedure; based on the determination of whether the security software followed a correct or incorrect procedure for contacting the server, determining whether to update or not update a level of trust associated with the user device; determining, based on the level of trust, how to process the one or more queries; and providing different responses to the one or more queries from the security software based on the determination of how to process the one or more queries.