1. In a computer system comprising hardware and software, the improvement comprising: a transducer instrumented within the hardware or the software of the computer system that monitors the computer system as the computer system operates and in response thereto generates given program activity data, wherein the transducer is code that monitors transitions across defined points within the operating environment of the computer system; a comparator that compares the given program activity data with data indicative of a normal operation of the computer system; and a device for outputting a given indication based on the comparison between the given program activity data and the data indicative of the normal operation of the computer system; wherein the given indication is indicative of an anomalous behavior resulting from a security violation in the computer system.