1. A method comprising: receiving information, wherein the information is related to a plurality of network sites; identifying a suspect network site of the plurality of network sites, wherein the identifying is based on the information, the information comprises a safety rating for the suspect network site, and the safety rating for the suspect network site is determined prior to the identifying; determining, using one or more processors, a probability that the safety rating for the suspect network site will change due to a security analysis of the suspect network site, wherein the determining is based, at least in part, on the safety rating for the suspect network site, and a portion of the information, wherein the portion of the information is associated with the suspect network site, and performance of the security analysis of the suspect network site depends on a determination of the probability.