1. A method for protecting a data processing system against attack by a vandal, the method comprising the steps of: determining, by a vulnerability scanner, a first externally visible vulnerability of the data processing system, said first externally visible vulnerability being on a list, said list appearing in a database accessed by the vulnerability scanner; providing, by the vulnerability scanner to an observation engine, a description of a first instance of a network flow to the data processing system such that the first instance of the network flow is associated with the first externally visible vulnerability; detecting, by the observation engine, the first instance of the network flow satisfying said description; instructing, by the observation engine, a blocker to block the detected first instance of the network flow, said instructing being in response to said detecting; and blocking, by the blocker, the first instance of the network flow, said blocking being in response to said instructing.