A method of securing a set of computers including a client computer (210, 1110), the method comprising: receiving, by a threat response platform (220, 1130) from a threat detection program communicatively connected to the client computer (210, 1110) in an enterprise computing network, an event report identifying a suspicious network communication between the client computer (210, 1110) and a network device (240, 1140); automatically, in response to determining that the client computer (210, 1110) has made the suspicious network communication, remotely installing an agent program on the client computer (210, 1110); automatically, remotely activating, by the threat response platform (220, 1130), the agent program on the client computer (210, 1110), the agent program configured for searching potential indications of compromise, IOCs, on the client computer (210, 1110) and sending data identifying the potential IOCs on the client computer (210, 1110) to the threat response platform (220, 1130) for evaluation; receiving, by the threat response platform (220, 1130) from the agent program, the data identifying the potential IOCs on the client computer (210, 1110); comparing, by the threat response platform (220, 1130), the potential IOCs on the client computer (210, 1110) and IOCs in a database local to the threat response platform (220, 1130); based at least in part on the comparing, determining, by the threat response platform (220, 1130), whether the potential IOCs on the client computer (210, 1110) indicate evidence of malware on the client computer (210, 1110); and responsive to the evidence of malware on the client computer (210, 1110), updating the database to include the evidence of malware determined by the threat response platform (220, 1130). receiving, by a threat response platform (220, 1130) from a threat detection program communicatively connected to the client computer (210, 1110) in an enterprise computing network, an event report identifying a suspicious network communication between the client computer (210, 1110) and a network device (240, 1140); automatically, in response to determining that the client computer (210, 1110) has made the suspicious network communication, remotely installing an agent program on the client computer (210, 1110); automatically, remotely activating, by the threat response platform (220, 1130), the agent program on the client computer (210, 1110), the agent program configured for searching potential indications of compromise, IOCs, on the client computer (210, 1110) and sending data identifying the potential IOCs on the client computer (210, 1110) to the threat response platform (220, 1130) for evaluation; receiving, by the threat response platform (220, 1130) from the agent program, the data identifying the potential IOCs on the client computer (210, 1110); comparing, by the threat response platform (220, 1130), the potential IOCs on the client computer (210, 1110) and IOCs in a database local to the threat response platform (220, 1130); based at least in part on the comparing, determining, by the threat response platform (220, 1130), whether the potential IOCs on the client computer (210, 1110) indicate evidence of malware on the client computer (210, 1110); and responsive to the evidence of malware on the client computer (210, 1110), updating the database to include the evidence of malware determined by the threat response platform (220, 1130).