1. A computer-implemented method, comprising: detecting a stability change in a computer system; identifying a first set of at least one capability of the computer system that is affected by the stability change; identifying, in response to detecting the stability change, a software application that was installed or updated to the computer system prior to the stability change; identifying a second set of at least one capability of the computer system that is utilized by the identified software application; comparing the first set of at least one capability to the second set of at least one capability to determine a degree of similarity; comparing a first time that the stability change was detected to a second time that the identified software application was installed or updated to determine a temporal proximity; and identifying the likelihood that the identified software application is the cause of the stability change, wherein the identified likelihood is a function of the degree of similarity and the temporal proximity.