1. A system comprising: a processing system including one or more processors; memory accessible to the processing system, wherein the memory stores instructions executable by at least one processor of the one or more processors to cause the at least one processor to perform operations comprising: instantiating a first detection agent based on detection criteria, wherein the first detection agent includes first program code executable by a second processor to monitor network activity; sending the first program code of the first detection agent to a remote computing device for execution, wherein, when the first program code of the first detection agent is executed at the remote computing device, the first detection agent causes network activity data to be transmitted to the processing system, and wherein the processing system updates the detection criteria based on the network activity data to generate updated detection criteria; instantiating a second detection agent based on the updated detection criteria wherein the second detection agent includes second program code; and sending second program code of the second detection agent to the remote computing device for execution.