1. A computer-implemented method for execution by one or more processors, the method comprising: intercepting a communication of a first type at a first node of a security system; extracting communication metadata from the communication, the communication metadata comprising a plurality of different fields, the plurality of different fields including first header fields from the communication, each of the first header fields including characters that describe a property of the communication; determining if the communication comprises an attached file; upon determining the communication comprises an attached file, extracting file metadata from the file, the file metadata comprising a second plurality of different fields, the second plurality of different fields including second header fields of the file different from the first header fields, each of the second header fields including characters that describe a property of the file; determining a score for each field of extracted metadata comprising the file metadata and the communication metadata, the score for each field of the extracted metadata indicative of a likelihood that the communication is a malicious communication, the score for each field of the extracted metadata determined based on previous communications; combining the scores for the plurality of fields of the extracted metadata to generate a combined score for the communication, the combined score based on an algorithm developed from the previous communications, the algorithm including assigning varying weights to one or more of the plurality of fields; generating, at a first time based on the combined score, a predicted classification providing a prediction as to whether the communication is a malicious communication; receiving, at a second time subsequent to the first time, an indication of whether the communication is a malicious communication; and updating the algorithm based on the indication of whether the communication is a malicious communication.