A method comprising: correlating, by a reputation server, a first set of event data from a private network; determining, by the reputation server, a local reputation score of a host in the private network based on the correlating the first set of event data, wherein the local reputation score of the host provides a historical risk score; providing, by the reputation server, the local reputation score of the host to a security node; correlating, by the reputation server, a second set of event data from the private network; determining, by the reputation server, a local reputation score of a user based on the correlating the second set of event data, wherein the local reputation score of the user provides a behavioral risk score which represents whether the user follows a policy for the private network; and providing, by the reputation server, the local reputation score of the user to the security node; wherein the security node dynamically selects and applies a first policy to a network communication associated with the host and the user if the local reputation scores of the host and the user exceed a first reputation score threshold, and selects and applies a second policy if the local reputation scores fall below the first reputation score threshold and exceed a second reputation score threshold, and further selects and applies a third policy if the local reputation scores fall below the second reputation score threshold, wherein the first, second, and third policies have varying levels of restrictiveness, and wherein the first reputation score threshold is different than the second reputation score threshold. correlating, by a reputation server, a first set of event data from a private network; determining, by the reputation server, a local reputation score of a host in the private network based on the correlating the first set of event data, wherein the local reputation score of the host provides a historical risk score; providing, by the reputation server, the local reputation score of the host to a security node; correlating, by the reputation server, a second set of event data from the private network; determining, by the reputation server, a local reputation score of a user based on the correlating the second set of event data, wherein the local reputation score of the user provides a behavioral risk score which represents whether the user follows a policy for the private network; and providing, by the reputation server, the local reputation score of the user to the security node; wherein the security node dynamically selects and applies a first policy to a network communication associated with the host and the user if the local reputation scores of the host and the user exceed a first reputation score threshold, and selects and applies a second policy if the local reputation scores fall below the first reputation score threshold and exceed a second reputation score threshold, and further selects and applies a third policy if the local reputation scores fall below the second reputation score threshold, wherein the first, second, and third policies have varying levels of restrictiveness, and wherein the first reputation score threshold is different than the second reputation score threshold.