1. A computing apparatus comprising: a network interface; and one or more logic elements comprising an outbreak pathology inference engine, operable for: receiving network telemetry data from a client device via the network interface; receiving out-of-network telemetry data from the client device via the network interface; and inferring, based at least in part on the network telemetry data and out-of-network data, a malware outbreak hypothesis.