1. A computer-implemented method for using event-correlation graphs to detect attacks on computing systems, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: detecting a suspicious event involving a first actor within a computing system; constructing, in response to detecting the suspicious event involving the first actor, an event-correlation graph, wherein the event-correlation graph comprises at least: a first node that represents the first actor; a second node that represents a second actor; an edge that: interconnects the first node and the second node; represents a suspicious event involving the first actor and the second actor; calculating, based at least in part on the additional suspicious event involving the first actor and the second actor, an attack score for the event-correlation graph; determining that the attack score is greater than a predetermined threshold; determining, based at least in part on the attack score being greater than the predetermined threshold, that the suspicious event comprises an attack on the computing system.