1. A method comprising: instrumenting, by a static instrumentation engine within software executed by a processor, an application of a computing system with at least a first monitoring function, the first monitoring function capable of operating in a run-time environment during processing of the instrumented application; tracking, by at least a second monitoring function, movement of data associated with the application, the data being at least partially identified by a storage location; determining whether movement of the data from a first storage location to a second storage location is suspicious; and reporting suspicious movement of the data.