1. A method comprising: installing at least one benign malware indicator on one or more computing devices; monitoring the one or more computing devices for the at least one benign malware indicator; and responsive to determining that the at least one benign malware indicator is no longer detected as present on at least one of the one or more computing devices, sending a notification indicating that the at least one benign malware indicator is no longer detected as present on the at least one of the one or more computing devices.