A method comprising: receiving, by a security device and from a device, network traffic directed to one or more computing devices protected by the security device, wherein the security device is one of a plurality of security devices (20A, 20B) associated with a security service; responsive to receiving the network traffic, sending, by the security device and to the device, a request for a plurality of data points for the device, wherein the data points include characteristics associated with the device; the request for the plurality of data points comprising injecting into a response intercepted from at least one of the one or more computing devices, code requesting the plurality of data points, wherein the intercepted response is sent by the at least one of the one or more computing devices in response to the network traffic; receiving, by the security device and from the device, at least a portion of the requested plurality of data points; comparing, by the security device, the received portion of the requested plurality of data points to respective sets of data points associated with one or more known attacker devices; determining, based on the comparison, whether a first respective set of data points associated with a first known attacker device satisfies a similarity threshold; responsive to determining that the first respective set of data points associated with the first known attacker device satisfies the similarity threshold, sending, by the security device, information relating to the received portion of the requested plurality of data points to the security service; and receiving, by the security device and from the security service, update information including information aggregated from others of the plurality of security devices about one or more attempted attacks. receiving, by a security device and from a device, network traffic directed to one or more computing devices protected by the security device, wherein the security device is one of a plurality of security devices (20A, 20B) associated with a security service; responsive to receiving the network traffic, sending, by the security device and to the device, a request for a plurality of data points for the device, wherein the data points include characteristics associated with the device; the request for the plurality of data points comprising injecting into a response intercepted from at least one of the one or more computing devices, code requesting the plurality of data points, wherein the intercepted response is sent by the at least one of the one or more computing devices in response to the network traffic; receiving, by the security device and from the device, at least a portion of the requested plurality of data points; comparing, by the security device, the received portion of the requested plurality of data points to respective sets of data points associated with one or more known attacker devices; determining, based on the comparison, whether a first respective set of data points associated with a first known attacker device satisfies a similarity threshold; responsive to determining that the first respective set of data points associated with the first known attacker device satisfies the similarity threshold, sending, by the security device, information relating to the received portion of the requested plurality of data points to the security service; and receiving, by the security device and from the security service, update information including information aggregated from others of the plurality of security devices about one or more attempted attacks.