1. A computer program product embodied on a non-transitory tangible computer readable medium for performing operations, comprising: using a profiling agent to monitor a plurality of update services that are associated with multiple update providers; identifying an update for a computer; populating a list of known wanted data with at least a portion of update data provided in the update, wherein the list reflects an aggregation of multiple update data sets from the multiple update providers and the list is based, at least in part, on the operating system and applications of the computer, and wherein the portion of the update data are reflective of data predetermined to exclude malware, and wherein the known wanted data includes a whitelist; and populating the list of known wanted data with metadata that indicates a version of the update data, a digital signature used to sign a portion of the update data, and a location from which the portion of the update data was received.