1. A method comprising: receiving a plurality of broadcasts comprising information identifying execution states and configurations of a plurality of software appliances, each broadcast is from a client system of a plurality of client systems, wherein at least two of the plurality of software appliances are installed on each of the plurality of client systems; determining, by a processor, whether a first software appliance of the plurality of software appliances that is installed on a first client system of the plurality of client systems is unauthorized in view of an execution state of the first software appliance and a configuration of a second software appliance of the plurality of software appliances; and generating a control action for the first client system when the first software appliance is determined to be unauthorized.