1. An automated method for detecting a compromised client computer in an enterprise network, the method comprising the steps of: arranging the enterprise network so that each of a plurality of endpoints in the enterprise network may communicate security assessments over a communication channel; receiving reputation data associated with a resource from a reputation service; analyzing, responsively to receiving, a log that is maintained by a traffic monitoring endpoint that is arranged to monitor traffic crossing a boundary of the enterprise network to retroactively identify any client computers that accessed the resource; and generating a security assessment that includes results from the analyzing.