1. A system for managing security of a computing device comprising: a pre-execution module operable for receiving notice from the computing device's operating system that a new program is being loaded onto the computing device; a validation module coupled to the pre-execution monitor operable for determining whether the program is valid; a detection module coupled to the pre-execution monitor operable for intercepting a trigger from the computing device's operating system; and an execution module coupled to the detection module and operable for monitoring, at the operating system kernel of the computing device, the program in response to the trigger intercepted by the detection module.