1. A method comprising: receiving a first analytics set performed on a first network security appliance operated internal to a first organization; receiving a second analytics set performed on a second network security appliance operated internal to a second organization; processing the first analytics set and the second analytics set; and responsive to the processing, disseminating to the second network security appliance information indicating that the second analytics set has also been performed on at least the first network security appliance, without revealing an identity of the first organization, wherein the first analytics set and the second analytics set indicate a velocity at which an administrator performed individual operations on the analytics sets.