1. A method for forensic monitoring, comprising: monitoring activity on a monitored apparatus; extracting, by a processor, forensic data based at least in part on monitored activity; causing transfer of the extracted forensic data from the monitored apparatus to a forensic analysis apparatus configured to archive the forensic data for a later analysis; and determining, by the forensic analysis apparatus, one or more key risk indicator values relating to the monitored apparatus based at least in part on the later analysis, wherein the key risk indicator values indicate potential risks of intrusion.