A computer system comprising the following: one or more processors; system memory; one or more computer-readable storage media having stored thereon computer-executable instructions that, when executed by the one or more processors, cause the computing system to perform a method for determining a risk of encountering malware based on social context, the method comprising the following: an act of receiving a malware notification associated with a user, the malware notification identifying at least one type of malware encountered by the user; an act of determining one or more traits of the identified type of malware, wherein at least one of the traits indicates whether the malware is propagated through email attachments or links, through infected application installation files, through infected websites or through other means of propagation; an act of identifying one or more persons that are part of a social group associated with the user; an act of determining that at least one of the identified persons associated with the user has an increased likelihood of encountering the identified type of malware, based on information derived from the act of identifying comprising assigning an increased likelihood to a user if said user interacts with a group member in a certain manner, and the identified type of malware is known to spread through that type of interaction; and an act of determining a specific threat level to one or more of the identified persons, the specific threat level being based on the traits of the identified type of malware and the types of interaction between the user and the one or more identified persons. one or more processors; system memory; one or more computer-readable storage media having stored thereon computer-executable instructions that, when executed by the one or more processors, cause the computing system to perform a method for determining a risk of encountering malware based on social context, the method comprising the following: an act of receiving a malware notification associated with a user, the malware notification identifying at least one type of malware encountered by the user; an act of determining one or more traits of the identified type of malware, wherein at least one of the traits indicates whether the malware is propagated through email attachments or links, through infected application installation files, through infected websites or through other means of propagation; an act of identifying one or more persons that are part of a social group associated with the user; an act of determining that at least one of the identified persons associated with the user has an increased likelihood of encountering the identified type of malware, based on information derived from the act of identifying comprising assigning an increased likelihood to a user if said user interacts with a group member in a certain manner, and the identified type of malware is known to spread through that type of interaction; and an act of determining a specific threat level to one or more of the identified persons, the specific threat level being based on the traits of the identified type of malware and the types of interaction between the user and the one or more identified persons. an act of receiving a malware notification associated with a user, the malware notification identifying at least one type of malware encountered by the user; an act of determining one or more traits of the identified type of malware, wherein at least one of the traits indicates whether the malware is propagated through email attachments or links, through infected application installation files, through infected websites or through other means of propagation; an act of identifying one or more persons that are part of a social group associated with the user; an act of determining that at least one of the identified persons associated with the user has an increased likelihood of encountering the identified type of malware, based on information derived from the act of identifying comprising assigning an increased likelihood to a user if said user interacts with a group member in a certain manner, and the identified type of malware is known to spread through that type of interaction; and an act of determining a specific threat level to one or more of the identified persons, the specific threat level being based on the traits of the identified type of malware and the types of interaction between the user and the one or more identified persons.