1. A method comprising: processing first timing data accessed from a validated clock source; processing second timing data accessed from an unvalidated receiver source, wherein the validated clock source is independent of the validated receiver source; comparing the processed first timing data with the processed second timing data for an adjustable interval of time to determine a threat detection value; and when the threat detection value meets a configurable threat detection threshold, generating a threat alert message, wherein the threat alert message identifies an anomaly in either the validated clock source or the unvalidated receiver source, wherein the comparing comprises analyzing the processed second timing data and the processed first timing data, wherein the analyzing comprises: detecting a pulse per second (PPS) received from the unvalidated receiver source, determining a quantity of cycles received from the validated clock source prior to the detected PPS, wherein the comparing further comprises: determining the threat detection value based on a comparison between the determined quantity of cycles and a predetermined expected clock cycle value.