1. A computing appliance for consuming security alerts from an alert source, the system comprising: one or more processors; a computer-readable memory; and an authentication program comprising executable instructions stored in the computer-readable memory, wherein the executable instructions direct the one or more processors to at least: receive, over a computer network, a security alert generated by a threat detection system in response to detecting that a user device logged in with a first user account has been compromised with malware, wherein the security alert is associated with a security threat; determine that the first user account is used to log in to the user device when the user device is compromised with the malware using the security alert; determine a security action to be executed by the one or more processors for controlling access to a secure computer-based resource that requires authentication of a user identity, the security action executed when the first user account is used in an attempt to access the secure computer-based resource, wherein the security action is determined based on the security alert and a security protocol; receive, over the computer network, a request to access the secure computer-based resource, wherein the request comprises an identification of a second user account; determine that the first user account matches the second user account; and execute the determined security action in response to determining that the first user account and the second user account match.