1. A computer-implemented method for protecting electronic content from unauthorized use performed by a computer system comprising a processor and a non-transitory computer-readable storage medium storing executable instructions that cause the computer system to perform the method, the method comprising: receiving a request to process electronic content using a software module executing on the computer system, wherein the software module comprises at least one of a video display driver, a sound driver, an SCSI driver, an IDE driver, a network driver, a video capture driver, a floppy disk driver, and a scanner driver; accessing a control policy associated with the electronic content; determining that the software module exhibits one or more predefined behaviors specified in the control policy, wherein determining that the software module exhibits the one or more predefined behaviors comprises detecting that the software module exhibits a request response time at least one of greater than a first threshold response time or shorter than a second threshold response time; and implementing at least one action to protect the electronic content from unauthorized use based on the determination, wherein the at least one action comprises modifying at least a portion of the electronic content before it is processed by the software module.