1. A method for monitoring executing software, the method comprising: monitoring behavior of software during execution; based on comparison of the monitored behavior and corresponding expected behavior derived from analysis of the software, determining that the monitored behavior deviates from the expected behavior in accordance with a predetermined trigger; and automatically initiating an action in response to the determining.