1. A computer system, comprising: a memory and a processor configured to execute instructions in the memory to cause the computer system to implement an aggregation routine, the aggregation routine configured to: identify a first suspicious event by analyzing metrics that are generated based on performance characteristics of the computer system; receive a report of a second suspicious event from at least one of multiple anti-malware services executing on the computer system; determine whether a combination of suspicious events is indicative of malware, the combination of suspicious events including at least the first suspicious event and the second suspicious event; and responsive to a determination that the combination of suspicious events is indicative of malware, apply a restrictive security policy configured to restrict an entity associated with the combination of suspicious events from performing actions on the computer system.