A method for providing security on externally connected controllers, the method comprising: receiving, at a server system, operation information for a plurality of instances of a controller, the plurality of instances (230a, 230b,... 230n) being installed across a plurality of devices (231a, 231b,... 231n), wherein: the plurality of instances of the controller include a security middleware layer that is incorporated into operating systems on the plurality of instances of the controller, and the security middleware layer is positioned to restrict one or more kernel processes of the operating system to operations that are permitted according to one or more security policies (158a, 158b,... 158n); statistically analyzing, by the server system, the operation information; identifying, by the server system, one or more anomalous controller behaviors based on the statistical analysis; providing, by the server system, information regarding the one or more anomalous controller behaviors on the controller as potential security threats; updating, by the server system, the one or more security policies (158a, 138b,... 158n) to exclude performance of the one or more anomalous controller behaviors in response to the information; and pushing out the updated one or more security policies (158a, 158b,... 158n) to the plurality of devices, wherein the plurality of instances of the controller block the one or more anomalous controller behaviors from being performed on the controller using the updated one or more security policies. receiving, at a server system, operation information for a plurality of instances of a controller, the plurality of instances (230a, 230b,... 230n) being installed across a plurality of devices (231a, 231b,... 231n), wherein: the plurality of instances of the controller include a security middleware layer that is incorporated into operating systems on the plurality of instances of the controller, and the security middleware layer is positioned to restrict one or more kernel processes of the operating system to operations that are permitted according to one or more security policies (158a, 158b,... 158n); the plurality of instances of the controller include a security middleware layer that is incorporated into operating systems on the plurality of instances of the controller, and the security middleware layer is positioned to restrict one or more kernel processes of the operating system to operations that are permitted according to one or more security policies (158a, 158b,... 158n); statistically analyzing, by the server system, the operation information; identifying, by the server system, one or more anomalous controller behaviors based on the statistical analysis; providing, by the server system, information regarding the one or more anomalous controller behaviors on the controller as potential security threats; updating, by the server system, the one or more security policies (158a, 138b,... 158n) to exclude performance of the one or more anomalous controller behaviors in response to the information; and pushing out the updated one or more security policies (158a, 158b,... 158n) to the plurality of devices, wherein the plurality of instances of the controller block the one or more anomalous controller behaviors from being performed on the controller using the updated one or more security policies.