1. An agent comprising: a monitor module configured to monitor a device for an instruction to execute a legitimate application; an application identification module configured to identify one or more attributes of the legitimate application; a vulnerability module configured to retrieve risk information based on the one or more attributes of the legitimate application, the risk information determined from known vulnerabilities of the legitimate application; a rules database for storing a rule associated with the risk information; a rule module configured to retrieve the rule from the rule database based on the risk information and to control the legitimate application based on the rule.