1. A method, comprising: receiving information from a sensor, wherein the information relates to a software classified by the sensor as unauthorized to execute on a computing system of the sensor; evaluating one or more pieces of data that includes the information, wherein the evaluating includes collating the one or more pieces of data; determining if any subset of the data can represent an identifier of the unauthorized software, wherein the subset is recognizable by a target type comprising a functionality of a target to update a response according to a directive specifying an action based on the subset; identifying the target type; generating the directive for the identified target type; and communicating the directive to one or more targets of the identified target type.