A method of game engine-based computer security, the method using components of a game engine architecture, components comprising a game engine sensor, a game engine logic controller and at least one game engine logic actuator comprising: receiving, at said game engine sensor of a computing device executing an operating system, first data from the operating system that represents occurrence of a monitored event, wherein the first data comprises an event data indicating an update to a system state associated with the computing device about the monitored event; sending, from the game engine sensor, second data corresponding to the monitored event to said game engine logic controller, comprising logic blocks, each logic block representing a respective predicate, wherein the second data is a modeled event data as a representation of the event data compatible with a system state model; determining, at a first logic block of the game engine logic controller based on the second data and third data representing the system state associated with the computing device, that a first predicate condition is satisfied; determining, at a second logic block of the game engine logic controller based on the second data and the third data, that a second predicate condition is satisfied, wherein the first and the second logic blocks are configured to be chained together such that an output of the first logic block is provided as input to the second logic block; detecting a computer security threat based on the chained first and second predicate conditions being satisfied; and based on detecting the computer security threat, instructing said at least one game engine actuator to perform at least one action responsive to the computer security threat, wherein the second data includes a type of the monitored event, a path of the monitored event, directory information associated with the monitored event, app information associated with the monitored event, or any combination thereof; or wherein the second data includes information regarding a file associated with the monitored event, whether the file is modified, information regarding content of the file, or any combination thereof, or wherein the second data includes information regarding an executing process associated with the monitored event, or wherein the second data includes tag data associated with the monitored event, tag data being determined by the first or the second logic block. receiving, at said game engine sensor of a computing device executing an operating system, first data from the operating system that represents occurrence of a monitored event, wherein the first data comprises an event data indicating an update to a system state associated with the computing device about the monitored event; sending, from the game engine sensor, second data corresponding to the monitored event to said game engine logic controller, comprising logic blocks, each logic block representing a respective predicate, wherein the second data is a modeled event data as a representation of the event data compatible with a system state model; determining, at a first logic block of the game engine logic controller based on the second data and third data representing the system state associated with the computing device, that a first predicate condition is satisfied; determining, at a second logic block of the game engine logic controller based on the second data and the third data, that a second predicate condition is satisfied, wherein the first and the second logic blocks are configured to be chained together such that an output of the first logic block is provided as input to the second logic block; detecting a computer security threat based on the chained first and second predicate conditions being satisfied; and based on detecting the computer security threat, instructing said at least one game engine actuator to perform at least one action responsive to the computer security threat, wherein the second data includes a type of the monitored event, a path of the monitored event, directory information associated with the monitored event, app information associated with the monitored event, or any combination thereof; or wherein the second data includes information regarding a file associated with the monitored event, whether the file is modified, information regarding content of the file, or any combination thereof, based on detecting the computer security threat, instructing said at least one game engine actuator to perform at least one action responsive to the computer security threat, wherein the second data includes a type of the monitored event, a path of the monitored event, directory information associated with the monitored event, app information associated with the monitored event, or any combination thereof; or wherein the second data includes information regarding a file associated with the monitored event, whether the file is modified, information regarding content of the file, or any combination thereof, or wherein the second data includes information regarding an executing process associated with the monitored event, or wherein the second data includes tag data associated with the monitored event, tag data being determined by the first or the second logic block.