A computer-implemented method for classifying security events as targeted attacks, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: detecting at least one malicious security event in connection with at least one organization; comparing the malicious security event against a targeted-attack taxonomy that comprises a plurality of categories, each category including a plurality of characteristics of targeted attacks; determining, based at least in part on comparing the malicious security event against the targeted-attack taxonomy, that the malicious security event is specifically targeting the organization by: calculating, based at least in part on comparing the malicious security event against the targeted-attack taxonomy, a category score for each category within the plurality of categories included in the targeted-attack taxonomy; determining the number of features of the malicious security event that match corresponding characteristics identified in the targeted-attack taxonomy; calculating, based at least in part on each category score and the number of features of the malicious security event that match corresponding characteristics identified in the targeted-attack taxonomy, a taxonomy score that represents the likelihood that the malicious security event is part of a targeted attack campaign as opposed to an indiscriminate or non-targeted attack; and determining that the taxonomy score exceeds a certain threshold; in response to determining that the malicious security event is specifically targeting the organization, classifying the malicious security event as part of a targeted attack campaign that is specifically targeting the organization instead of an indiscriminate or non-targeted attack. detecting at least one malicious security event in connection with at least one organization; comparing the malicious security event against a targeted-attack taxonomy that comprises a plurality of categories, each category including a plurality of characteristics of targeted attacks; determining, based at least in part on comparing the malicious security event against the targeted-attack taxonomy, that the malicious security event is specifically targeting the organization by: calculating, based at least in part on comparing the malicious security event against the targeted-attack taxonomy, a category score for each category within the plurality of categories included in the targeted-attack taxonomy; determining the number of features of the malicious security event that match corresponding characteristics identified in the targeted-attack taxonomy; calculating, based at least in part on each category score and the number of features of the malicious security event that match corresponding characteristics identified in the targeted-attack taxonomy, a taxonomy score that represents the likelihood that the malicious security event is part of a targeted attack campaign as opposed to an indiscriminate or non-targeted attack; and determining that the taxonomy score exceeds a certain threshold; calculating, based at least in part on comparing the malicious security event against the targeted-attack taxonomy, a category score for each category within the plurality of categories included in the targeted-attack taxonomy; determining the number of features of the malicious security event that match corresponding characteristics identified in the targeted-attack taxonomy; calculating, based at least in part on each category score and the number of features of the malicious security event that match corresponding characteristics identified in the targeted-attack taxonomy, a taxonomy score that represents the likelihood that the malicious security event is part of a targeted attack campaign as opposed to an indiscriminate or non-targeted attack; and determining that the taxonomy score exceeds a certain threshold; in response to determining that the malicious security event is specifically targeting the organization, classifying the malicious security event as part of a targeted attack campaign that is specifically targeting the organization instead of an indiscriminate or non-targeted attack.