1. A computer implemented method exchanging data traffic between a security software module of a computing device and a hardware component on a hardware platform of the computing device, the security software module including an intrusion detection system, the hardware component including a network interface controller; during the exchanging data traffic, maintaining a first running count of packets of data traffic observed by the hardware component, and maintaining a second running count of packets of data traffic observed by the security software module; generating hardware statistics based on the first running count; generating software statistics based on the second running count; sending the hardware statistics and the software statistics to a correlation agent of the computing device; the correlation agent evaluating a correlation between the hardware statistics and the software statistics, the evaluating including testing an amount of data determined to have been observed by the security software module with an amount of data determined to have been observed by the network interface controller; determining that a security risk is indicated by a result of the evaluating; and in response to determining that the security risk is indicated, triggering a remedial procedure including at least one of sending an alert of the security risk and sending an instruction to change a security setting related to the hardware platform.