1. A computer-implemented method for execution by one or more processors, the method comprising: intercepting a communication at a first node of a security system; extracting communication metadata associated with the communication, the communication metadata comprising a plurality of different fields; determining if the communication comprises an attached file; upon determining the communication comprises an attached file, extracting file metadata associated with the file, the file metadata comprising a second plurality of different fields; determining a score for each field of extracted metadata comprising the file metadata and the communication metadata, the score for each field of the extracted metadata indicative of a likelihood that the communication is a malicious communication, the score for each field of the extracted metadata determined based on previous communications; combining the scores for the plurality of fields of the extracted metadata to generate a combined score for the communication, the combined score based on an algorithm developed from the previous communications; generating, at a first time based on the combined score, a predicted classification providing a prediction as to whether the communication is a malicious communication; receiving, at a second time subsequent to the first time, an indication of whether the communication is a malicious communication; and updating the algorithm based on the indication of whether the communication is a malicious communication.