1. A computer-implemented method to protect against a vulnerability event, comprising: enforcing, by a processor, a first set of security policies on a client device, wherein the processor is a hardware processor; subscribing, by the processor, to an update notification service to obtain notifications regarding update events, the update events relating to operating system updates and host protection software updates; monitoring, by the processor, the updated events, wherein monitoring the update events comprises monitoring the update events relating to the operating system and host protection software in relation to termination of a malware detection service; detecting, by the processor, an update event in conjunction with subscribing to the update notification service; determining, by the processor, whether the update event is known to cause temporary disruption to the malware detection service; upon determining the update event is known to not cause temporary disruption to the malware detection service, maintaining, by the processor, the first set of security policies; and upon determining the update event is known to cause temporary disruption to the malware detection service: determining, by the processor, a vulnerability level corresponding to a first type of network connection or a second type of network connection, wherein the vulnerability level is at a first level when a current network connection is of the first type and the vulnerability level is at a second level when the current network connection is of the second type; selecting, by the processor, a second set of security policies based on the vulnerability level; and enforcing, by the processor, the second set of security policies.