1. A computer-implemented method comprising: installing, using a computer processor, on one or more computing devices, a single benign malware indicator file resembling a piece of evidence resulting from a genuine malware infection, wherein the benign malware indicator is an inert, harmless or non-functional file, or a modification to an existing file, and wherein the benign malware indicator is a copy of evidence resulting from a genuine malware infection, or an imitation of evidence resulting from a genuine malware infection; monitoring, using the computer processor, the one or more computing devices for the benign malware indicator; responsive to determining that the benign malware indicator is no longer detected as present on at least one of the one or more computing devices, sending a notification, using the computer processor, indicating that the benign malware indicator is no longer detected as present on the at least one of the one or more computing devices; responsive to detecting removal of the benign malware indicator from the at least one of the one or more computing devices, identifying, using the computer processor, a plurality of software programs installed on the one or more computing devices; comparing, using the computer processor, each of the plurality of software programs to a list of approved software programs to identify one or more unauthorized software programs installed on at least one of the one or more computing devices; and sending, using the computer processor, a notification indicating that the one or more unauthorized software programs are installed on the at least one of the one or more computing devices, wherein the plurality of software programs installed on the one or more computing devices comprises one or more antivirus programs installed on the one or more computing devices, wherein the list of approved software programs comprises one or more approved antivirus programs, and wherein the notification indicates an unauthorized antivirus program is present.