A computer-implemented method comprising: executing, on a processor of a host computer system, a software publisher trust extension application, the executing including: determining whether an unknown application is being executed, where an unknown application is an application without an assigned reputation, and where a reputation of an application is an overall trustworthiness as determined by a security vendor or security product; determining a software publisher of the unknown application, determining reputations of users of applications of the software publisher wherein the reputation of a user is one of a first reputation of having malicious code on their computer system and of a second reputation of not having malicious code on their computer system; determining a reputation of the software publisher of the unknown application by collectively aggregating the determined reputations of the users of applications of the software publisher, and assigning said reputation of the software publisher to said unknown application upon a determination that said software publisher does have the reputation, where the assigning of the reputation changes the unknown application to a known application; determining whether said known application is being executed, wherein upon a determination that said known application is being executed, determining whether said reputation of said known application allows said execution; and upon a determination that said reputation of said known application does not allow said execution, taking protective action. executing, on a processor of a host computer system, a software publisher trust extension application, the executing including: determining whether an unknown application is being executed, where an unknown application is an application without an assigned reputation, and where a reputation of an application is an overall trustworthiness as determined by a security vendor or security product; determining a software publisher of the unknown application, determining reputations of users of applications of the software publisher wherein the reputation of a user is one of a first reputation of having malicious code on their computer system and of a second reputation of not having malicious code on their computer system; determining a reputation of the software publisher of the unknown application by collectively aggregating the determined reputations of the users of applications of the software publisher, and assigning said reputation of the software publisher to said unknown application upon a determination that said software publisher does have the reputation, where the assigning of the reputation changes the unknown application to a known application; determining whether said known application is being executed, wherein upon a determination that said known application is being executed, determining whether said reputation of said known application allows said execution; and upon a determination that said reputation of said known application does not allow said execution, taking protective action. determining whether an unknown application is being executed, where an unknown application is an application without an assigned reputation, and where a reputation of an application is an overall trustworthiness as determined by a security vendor or security product; determining a software publisher of the unknown application, determining reputations of users of applications of the software publisher wherein the reputation of a user is one of a first reputation of having malicious code on their computer system and of a second reputation of not having malicious code on their computer system; determining a reputation of the software publisher of the unknown application by collectively aggregating the determined reputations of the users of applications of the software publisher, and assigning said reputation of the software publisher to said unknown application upon a determination that said software publisher does have the reputation, where the assigning of the reputation changes the unknown application to a known application; determining whether said known application is being executed, wherein upon a determination that said known application is being executed, determining whether said reputation of said known application allows said execution; and upon a determination that said reputation of said known application does not allow said execution, taking protective action.