1. A method comprising: correlating a first set of event data from a private network; determining a local reputation score of a host in the private network based on the correlating the first set of event data; and providing the local reputation score of the host to a security node, wherein the security node applies a policy, based on the local reputation score of the host, to a network communication associated with the host.