1. A method of detecting security attacks on a networked computer system, comprising: activating a remote sensor, the remote sensor having a wireless or wired adapter, cellular modem, processor, storage and memory, the remote sensor configured and arranged to emulate a client workstation; connecting the remote sensor to a computer network, the computer network having an unknown security status; establishing a secure communications tunnel between the remote sensor and a server, the server configured and arranged to issue commands to the remote sensor and receive alert information from the remote sensor; detecting a security event with the remote sensor comprises capturing internet protocol events by: comparing one or more patterns from one or more other attackers; comparing one or more detected behaviors from one or more other active attack detection systems; with the server, determining a threat level the security event poses to a user of the computer network; and issuing a threat assessment from the server to the user before the user accesses the computer network.