1. A computing device comprising: a storage containing a graylist executable object; and one or more logic elements comprising a security engine operable for: detecting that the executable object has attempted to perform an action; intercepting the action; querying a confidence score cache for a cached confidence score for a combination of the executable object and the action; assigning a present confidence score to the action, the present confidence score for a combination of the executable object and the action, and accounting for the cached confidence score; acting on the present confidence score, comprising operating a machine learning algorithm configured to compare the present confidence score to confidence scores of one or more other objects previously authorized by a user, determining that the present confidence score equals or exceeds the confidence scores of the one or more other objects, and authorizing the action without asking for user verification; and caching the present confidence score to the confidence score cache.