A computing system, comprising: at least one processor; and memory holding computer-readable instructions, which, when executed by the at least one processor, cause the computer system to: configure a validation instrumentation based on a user configuration input, the configured validation instrumentation configured to validate a remedial action performed in the computing system in response to a detected malicious activity in the computing system: select a subset of machines from a plurality of machines in a production environment of the computing system; configure the subset of selected machines in an isolated environment, the subset of selected machines functionally isolated from other machines in the production environment; receive a user scheduling input identifying scheduling criteria, under which the configured validation instrumentation is to be run on the computing system; and based on detecting presence of the scheduling criteria, automatically run the configured validation instrumentation to validate the remedial action on the selected machines in the isolated environment; and return the subset of machines to the production environment after the validation is performed. at least one processor; and memory holding computer-readable instructions, which, when executed by the at least one processor, cause the computer system to: configure a validation instrumentation based on a user configuration input, the configured validation instrumentation configured to validate a remedial action performed in the computing system in response to a detected malicious activity in the computing system: select a subset of machines from a plurality of machines in a production environment of the computing system; configure the subset of selected machines in an isolated environment, the subset of selected machines functionally isolated from other machines in the production environment; receive a user scheduling input identifying scheduling criteria, under which the configured validation instrumentation is to be run on the computing system; and based on detecting presence of the scheduling criteria, automatically run the configured validation instrumentation to validate the remedial action on the selected machines in the isolated environment; and return the subset of machines to the production environment after the validation is performed. configure a validation instrumentation based on a user configuration input, the configured validation instrumentation configured to validate a remedial action performed in the computing system in response to a detected malicious activity in the computing system: select a subset of machines from a plurality of machines in a production environment of the computing system; configure the subset of selected machines in an isolated environment, the subset of selected machines functionally isolated from other machines in the production environment; receive a user scheduling input identifying scheduling criteria, under which the configured validation instrumentation is to be run on the computing system; and based on detecting presence of the scheduling criteria, automatically run the configured validation instrumentation to validate the remedial action on the selected machines in the isolated environment; and return the subset of machines to the production environment after the validation is performed.