A computerized method for verifying one or more security threats arising from potentially malicious code executing at any of a plurality of endpoints in a private computer network, where the method includes generating a report by a threat monitor (100, 200) coupled to the private computer network and the report includes information resulting from the threat monitor (100, 200) capturing a portion of network data, extracting any executable code from the portion of the network data, and analyzing the extracted executable code to produce the information about the executable code representing a potential network threat: receiving, by a report analyzer implemented as part of a verifier (110, 210), the report; analyzing, by the report analyzer of the verifier (110, 210), the information within the report to yield intelligence that includes at least threat indicators and executable instructions directed to performing an audit for indicators matching the threat indicators to seek evidence whether the potentially malicious code has been executed on any of the plurality of endpoints; selecting, by an agent coordinator implemented as part of the verifier (110, 210), based on the intelligence, one or more endpoints of the plurality of endpoints each configured to conduct an audit of the executable code; issuing, by the agent coordinator, at least a threat indicator of the threat indicators and at least an instruction of the executable instructions over a communication network to an endpoint agent (120, 220) of each endpoint of the selected one or more endpoints that is to: (i) receive at least the instruction of the executable instructions and the threat indicator of the threat indicators, (ii) conduct an audit, in accordance with at least the instruction of the executable instructions, of data in a memory of the endpoint for an indicator that matches at least one of the threat indicators, (iii) obtain verification information comprising results of the audit conducted by the endpoint, and (iv) transmit the verification information over the communication network to the verifier (110, 210); gathering and correlating, at the verifier (110, 210), the verification information from each endpoint agent (120, 220) of the selected one or more endpoints to determine, based on the correlation, whether the executable code corresponds to malicious code and the verification information corresponds to a verified threat; and sending a notification including a portion of the verification information to identify the verified threat and to identify each of the one or more endpoints evidencing the verified threat. receiving, by a report analyzer implemented as part of a verifier (110, 210), the report; analyzing, by the report analyzer of the verifier (110, 210), the information within the report to yield intelligence that includes at least threat indicators and executable instructions directed to performing an audit for indicators matching the threat indicators to seek evidence whether the potentially malicious code has been executed on any of the plurality of endpoints; selecting, by an agent coordinator implemented as part of the verifier (110, 210), based on the intelligence, one or more endpoints of the plurality of endpoints each configured to conduct an audit of the executable code; issuing, by the agent coordinator, at least a threat indicator of the threat indicators and at least an instruction of the executable instructions over a communication network to an endpoint agent (120, 220) of each endpoint of the selected one or more endpoints that is to: (i) receive at least the instruction of the executable instructions and the threat indicator of the threat indicators, (ii) conduct an audit, in accordance with at least the instruction of the executable instructions, of data in a memory of the endpoint for an indicator that matches at least one of the threat indicators, (iii) obtain verification information comprising results of the audit conducted by the endpoint, and (iv) transmit the verification information over the communication network to the verifier (110, 210); (i) receive at least the instruction of the executable instructions and the threat indicator of the threat indicators, (ii) conduct an audit, in accordance with at least the instruction of the executable instructions, of data in a memory of the endpoint for an indicator that matches at least one of the threat indicators, (iii) obtain verification information comprising results of the audit conducted by the endpoint, and (iv) transmit the verification information over the communication network to the verifier (110, 210); gathering and correlating, at the verifier (110, 210), the verification information from each endpoint agent (120, 220) of the selected one or more endpoints to determine, based on the correlation, whether the executable code corresponds to malicious code and the verification information corresponds to a verified threat; and sending a notification including a portion of the verification information to identify the verified threat and to identify each of the one or more endpoints evidencing the verified threat.