1. A computer-implemented method of collecting local machine events and aggregating the knowledge base of anti-malware services and other event detection systems to proactively protect a computer from malware, the method comprising: (a) using the anti-malware services and other event detection systems to observe suspicious events that are potentially indicative of malware; (b) determining whether the suspicious events satisfy a predetermined threshold; and (c) if the suspicious events satisfy the predetermined threshold, applying a restrictive security policy to the computer.