A method, comprising: receiving, by a processor, context data associated with a context for a first computing device; identifying, based on the context data, a first policy that is applicable for the context of the first computing device, the first policy having policy characteristics regarding access permissions for software installed on computing devices; identifying a second policy implemented on the first computing device, the second policy having policy characteristics regarding an access permission for first software on the first computing device; comparing the policy characteristics of the first policy to the second policy, and determining that the access permission for the first software does not comply with the first policy; determining, by the processor, that the first software is associated with a first security threat wherein determining that the first software is associated with the first security threat comprises: determining that second software on a second computing device is associated with a second security threat, wherein the second software is obtained from a source; determining that the first software is obtained from the source; and evaluating, by the processor, the first software to determine that the first software is associated with the first security threat; and based on determining that the access permission for the first software does not comply with the first policy and the first software is associated with the first security threat, revoking the access permission for the first software. receiving, by a processor, context data associated with a context for a first computing device; identifying, based on the context data, a first policy that is applicable for the context of the first computing device, the first policy having policy characteristics regarding access permissions for software installed on computing devices; identifying a second policy implemented on the first computing device, the second policy having policy characteristics regarding an access permission for first software on the first computing device; comparing the policy characteristics of the first policy to the second policy, and determining that the access permission for the first software does not comply with the first policy; determining, by the processor, that the first software is associated with a first security threat wherein determining that the first software is associated with the first security threat comprises: determining that second software on a second computing device is associated with a second security threat, wherein the second software is obtained from a source; determining that the first software is obtained from the source; and evaluating, by the processor, the first software to determine that the first software is associated with the first security threat; and determining that second software on a second computing device is associated with a second security threat, wherein the second software is obtained from a source; determining that the first software is obtained from the source; and evaluating, by the processor, the first software to determine that the first software is associated with the first security threat; and based on determining that the access permission for the first software does not comply with the first policy and the first software is associated with the first security threat, revoking the access permission for the first software.