1. A method performed by a data processing apparatus, the method comprising: monitoring source assets in a network for activities indicative of potential security compromises, wherein the network comprises an internet protocol based network logically independent from other internet protocol networks, and each activity to be monitored is associated with a corresponding activity weight to indicate probability of the respective activity resulting from a respective, actual security compromise; determining that a particular one of the monitored source assets performs a particular monitored activity indicative of a potential security compromise, wherein the particular activity comprises a download of an executable having a malicious reputation; instantiating a particular source asset tracking instance in a computer memory, the source asset tracking instance including data identifying the particular source asset and the particular monitored activity, wherein the source asset tracking instance is to be updated based on identification of subsequently monitored activities, performed by the particular source asset, indicative of potential security compromises; determining a reputation value for the corresponding activity weight of the particular monitored activity based at least in part on the malicious reputation of the executable; adjusting, for the particular source asset, the corresponding activity weight of the particular monitored activity based at least in part on the reputation value; determining an asset reputation for the particular source asset from the corresponding activity weights associated with monitored activities involving the particular source asset; and determining a security risk associated with the particular source asset when the asset reputation exceeds a threshold.