1. An apparatus for security management in a data, voice, or video network comprising, in combination: at least one data collector; precursor discovery means for identifying, among collected data, at least one precursor of an attack on said network; at least one monitor for detecting the presence of at least one of said identified precursors on said network; and at least one means for protecting at least one of said network, one or more associated applications, one or more associated systems, and one or more associated network services when at least one of said identified precursors is detected.