1. A method for computer security, comprising: detecting a potential threat to a computing system; determining whether an authorized change in a configuration of the computing system corresponds to the potential threat; determining whether an authorized change in software of the computing system corresponds to the potential threat; and classifying the potential threat as an actual threat if the potential threat does not correspond to the authorized change in the configuration or the authorized change in the software.