1. A system comprising: a device to: inspect one or more network activities on a network; generate metadata associated with malware activity based on inspecting the one or more network activities; extract one or more threat events on the network based on the metadata; detect one or more incidents based on a correlation between a first threat event, of the one or more threat events, and a second threat event of the one or more threat events, the correlation being determined based on the metadata and a kill chain progression of the one or more threat events; generate risk scores for the one or more incidents based on the kill chain progression, the risk scores being based on one or more asset values for one or more targeted devices, and a first score, associated with a first stage of the kill chain progression, of the risk scores being lower than a second score, associated with a second stage of the kill chain progression, of the risk scores; and mitigate the one or more incidents based on the risk scores, the mitigation including quarantining data associated with the one or more network activities.