1. A method for protecting a data processing system against attack by a vandal, the method comprising the steps of: blocking, by a hardware blocker, a first instance of a network flow to the data processing system, said first instance of the network flow having been detected by an observation engine of the apparatus and being associated with a first externally visible vulnerability of the data processing system, said first externally visible vulnerability having been determined by a vulnerability scanner of the apparatus, lifting, by the observation engine, a blocking of an earlier-blocked instance of the network flow, wherein the earlier-blocked instance of the network flow had been blocked by the hardware blocker due to having satisfied a description of the earlier-blocked instance provided by the vulnerability scanner responsive to the vulnerability scanner having determined a second externally visible vulnerability of the data processing system such that the earlier-blocked instance of the network flow is associated with the second externally visible vulnerability.