1. A computing system comprising: a security apparatus comprising, a pointer identifier to identify a stack pointer associated with a sequence of code being executed on the computing system, a counter to count a number of exchange updates to the stack pointer, and a communication interface to generate a hardware interrupt if the number of exchange updates reaches a threshold; and at least one computer readable storage medium comprising a set of security instructions, which when executed by the computing system, cause the computing system to, receive the hardware interrupt, and determine whether the hardware interrupt corresponds to an unauthorized stack pivot.