1. In a computing environment, a method performed at least in part on at least one processor, comprising: computing a score indicative of a likelihood of malware being activated on a computing device based upon vulnerability model data and past user behavior data in which the score comprises a probability of encountering the malware, a probability of a user activating the malware, and a probability of the computing device being affected by the malware if activated; and based on the score, taking a protective action to mitigate damage that otherwise is able to result if the malware is activated.