1. A method comprising: observing, by a monitoring unit executing on a network security device operable to protect a private network, activities relating to a plurality of monitored devices within the private network; for each of the observed activities, assigning, by the monitoring unit, a score to the observed activity based upon a policy of a plurality of polices established within the monitoring unit; for each of the plurality of monitored devices, maintaining, by the monitoring unit, a current reputation score for the monitored device based upon the score and a historical score associated with the monitored device; and classifying, by the monitoring unit, a monitored device of the plurality of monitored devices as potentially being a malicious resource based upon the current reputation score for the monitored device.