A computing system implemented method for providing a security threat scoring service to identify and prioritize potential security threats for an online service, comprising: determining, with a computing system, security threat patterns by: monitoring first traffic between the online service and a test program, wherein the first traffic includes requests for information transmitted to the online service from the test program, wherein the online service executes the test program using sequentially one or more application programming interfaces, APIs, of the online service, and wherein the test program and the online service are hosted by a first asset computing environment; recording patterns associated with the first traffic between the test program and the online service, wherein the patterns associated with the first traffic include durations of delays between transmission of requests from the test program to the online service; and defining deviations from the patterns as the security threat patterns; comparing second traffic to the security threat patterns, wherein the second traffic is between one or more external computing systems (111, 112, 113), which are outside the first asset computing environment, and the online service; identifying portions of the second traffic as a potential security threat, if the portions of the second traffic correlate with at least one of the security threat patterns; assigning a threat score to the potential security threat at least partially based on a potential impact of the potential security threat on the online service; and providing the threat score to the online service to enable the online service to secure against the potential security threat. determining, with a computing system, security threat patterns by: monitoring first traffic between the online service and a test program, wherein the first traffic includes requests for information transmitted to the online service from the test program, wherein the online service executes the test program using sequentially one or more application programming interfaces, APIs, of the online service, and wherein the test program and the online service are hosted by a first asset computing environment; recording patterns associated with the first traffic between the test program and the online service, wherein the patterns associated with the first traffic include durations of delays between transmission of requests from the test program to the online service; and defining deviations from the patterns as the security threat patterns; monitoring first traffic between the online service and a test program, wherein the first traffic includes requests for information transmitted to the online service from the test program, wherein the online service executes the test program using sequentially one or more application programming interfaces, APIs, of the online service, and wherein the test program and the online service are hosted by a first asset computing environment; recording patterns associated with the first traffic between the test program and the online service, wherein the patterns associated with the first traffic include durations of delays between transmission of requests from the test program to the online service; and defining deviations from the patterns as the security threat patterns; comparing second traffic to the security threat patterns, wherein the second traffic is between one or more external computing systems (111, 112, 113), which are outside the first asset computing environment, and the online service; identifying portions of the second traffic as a potential security threat, if the portions of the second traffic correlate with at least one of the security threat patterns; assigning a threat score to the potential security threat at least partially based on a potential impact of the potential security threat on the online service; and providing the threat score to the online service to enable the online service to secure against the potential security threat.