A system comprising: a processing system including one or more processors; memory accessible to the processing system, wherein the memory stores instructions executable by at least one processor of the one or more processors to cause the at least one processor to perform operations comprising: instantiating a first detection agent based on detection criteria, wherein the first detection agent includes first program code executable by a remote computing device to monitor network activity; sending the first program code of the first detection agent to the remote computing device for execution, wherein, when the first program code of the first detection agent is executed at the remote computing device, the first detection agent causes network activity data to be transmitted to the processing system, and wherein the processing system updates the detection criteria based on the network activity data to generate updated detection criteria; instantiating a second detection agent based on the updated detection criteria wherein the second detection agent includes second program code; sending second program code of the second detection agent to the remote computing device for execution, instantiating at least one additional agent, the at least one additional agent including a defense agent, an attack agent, or both; and sending program code of the at least one additional agent to the remote computing device for execution, wherein the first program code of the first detection agent further includes instructions to authenticate other agents and to exchange secure messages with the other agents to trigger selection and/or execution of a particular counterattack action by the attack agent and/or a particular defense action by the defense agent independently of the processing system. a processing system including one or more processors; memory accessible to the processing system, wherein the memory stores instructions executable by at least one processor of the one or more processors to cause the at least one processor to perform operations comprising: instantiating a first detection agent based on detection criteria, wherein the first detection agent includes first program code executable by a remote computing device to monitor network activity; sending the first program code of the first detection agent to the remote computing device for execution, wherein, when the first program code of the first detection agent is executed at the remote computing device, the first detection agent causes network activity data to be transmitted to the processing system, and wherein the processing system updates the detection criteria based on the network activity data to generate updated detection criteria; instantiating a second detection agent based on the updated detection criteria wherein the second detection agent includes second program code; sending second program code of the second detection agent to the remote computing device for execution, instantiating at least one additional agent, the at least one additional agent including a defense agent, an attack agent, or both; and sending program code of the at least one additional agent to the remote computing device for execution, instantiating a first detection agent based on detection criteria, wherein the first detection agent includes first program code executable by a remote computing device to monitor network activity; sending the first program code of the first detection agent to the remote computing device for execution, wherein, when the first program code of the first detection agent is executed at the remote computing device, the first detection agent causes network activity data to be transmitted to the processing system, and wherein the processing system updates the detection criteria based on the network activity data to generate updated detection criteria; instantiating a second detection agent based on the updated detection criteria wherein the second detection agent includes second program code; sending second program code of the second detection agent to the remote computing device for execution, instantiating at least one additional agent, the at least one additional agent including a defense agent, an attack agent, or both; and sending program code of the at least one additional agent to the remote computing device for execution, wherein the first program code of the first detection agent further includes instructions to authenticate other agents and to exchange secure messages with the other agents to trigger selection and/or execution of a particular counterattack action by the attack agent and/or a particular defense action by the defense agent independently of the processing system.