1. A system comprising: a computing cloud comprising at least one data storage unit and at least one processing unit; wherein the computing cloud is configured to connect to a client, monitor traffic associated with the client, determine an operational mode of the client, generate a value for a condition of the monitored traffic, compare the generated value for the condition of the monitored traffic with a value for an anticipated traffic pattern associated with the operational mode to form a comparison, and determine if a security threat is indicated based on the comparison; wherein, to generate the value for the condition of the monitored traffic, the computing cloud is configured to generate the value for the condition of the monitored traffic based on a number of factors including a number of destination Internet Protocol addresses for the traffic associated with the client, an amount of network bandwidth used at the client, and ports over which the traffic associated with the client is being transmitted.