1. A computer-implemented method for protecting software, comprising: monitoring protected software in a testing environment in which the protected software is insulated from attacks; responsive to the monitoring in the testing environment, detecting at least one security event caused by the protected software while in the testing environment; providing a remediation for the at least one security event; and maintaining information indicating an association between the at least one security event and the remediation.