1. A non-transitory computer-readable medium carrying one or more sequences of instructions for providing security to a computer system, which instructions, when executed by one or more processors, cause the one or more processors to perform: monitoring occurrence of events associated with the computer system; in response to detecting occurrence of a given event in the computer system, initiating execution of an audit rule associated with the given event to provide notification that a corresponding protection policy associated with the given event should be currently operating to protect the computer system; evaluating whether the corresponding protection policy is currently operating in the computer system; in response to identifying that the corresponding protection policy should be but is not currently operating in the computer system, initiating application of a security measure to protect the computer system; wherein the monitoring includes initiating execution of an audit policy and a corresponding set of rules in the computer system that, when executed in the computer system, selectively provide notification of which of multiple types of protection policies should be currently activated in the computer system to protect the computer system against known computer attacking software in response to detecting activities in the computer system that are indicative of the known computer attacking software.