1. A computerized method, comprising: at a client security agent: initializing probability settings, based on information about known types of security attacks and representing an initial level of a security policy; detecting an occurrence of a key event from a plurality of key events and collecting event data that represent effects caused by the occurrence of the key event; selecting one or more first rules that take into consideration the effects caused by the occurrence of the key event, and applying the one or more first rules to the collected event data to compute one or more event result values; in response to determining that the one or more event result values exceeded one or more corresponding threshold values, modifying the probability settings to increase the level of the security policy above the initial level, applying one or more second rules to the modified probability settings and determining whether a new type of security attack has occurred; wherein the one or more corresponding threshold values represent respective percentages of probabilities that the new type of security attack is occurring; wherein the method is performed by one or more computing devices.