1. A method, comprising: intercepting an execution attempt by software on a computing system; classifying the software as authorized or unauthorized to execute on the computing system based on a set of identifiers that represents a set of software authorized to execute on the computing system; gathering information if the software is classified as unauthorized to execute on the computing system; and sending the information to one or more actuators for analysis and generation of a directive for one or more targets.