A device, comprising: one or more memories; and one or more processors to: receive network segment information identifying network segments associated with a network; receive endpoint host session information identifying sessions associated with endpoint hosts communicating with the network; generate, based on the network segment information and the endpoint host session information, a data structure that includes information associating the network segments with the sessions associated with the endpoint hosts; update the data structure based on changes in the sessions associated with the endpoint hosts and based on changes in locations of the endpoint hosts within the network segments; identify, based on the data structure, a particular endpoint host, of the endpoint hosts, that changed locations within the network segments; determine a threat policy action to enforce for the particular endpoint host; identify network control systems associated with the endpoint hosts; add, to the data structure, information identifying the network control systems associated with the endpoint hosts, and cause the threat policy action to be enforced, by one or more of the network control systems, based on the data structure, for the particular endpoint host. one or more memories; and one or more processors to: receive network segment information identifying network segments associated with a network; receive endpoint host session information identifying sessions associated with endpoint hosts communicating with the network; generate, based on the network segment information and the endpoint host session information, a data structure that includes information associating the network segments with the sessions associated with the endpoint hosts; update the data structure based on changes in the sessions associated with the endpoint hosts and based on changes in locations of the endpoint hosts within the network segments; identify, based on the data structure, a particular endpoint host, of the endpoint hosts, that changed locations within the network segments; determine a threat policy action to enforce for the particular endpoint host; identify network control systems associated with the endpoint hosts; add, to the data structure, information identifying the network control systems associated with the endpoint hosts, and cause the threat policy action to be enforced, by one or more of the network control systems, based on the data structure, for the particular endpoint host. receive network segment information identifying network segments associated with a network; receive endpoint host session information identifying sessions associated with endpoint hosts communicating with the network; generate, based on the network segment information and the endpoint host session information, a data structure that includes information associating the network segments with the sessions associated with the endpoint hosts; update the data structure based on changes in the sessions associated with the endpoint hosts and based on changes in locations of the endpoint hosts within the network segments; identify, based on the data structure, a particular endpoint host, of the endpoint hosts, that changed locations within the network segments; determine a threat policy action to enforce for the particular endpoint host; identify network control systems associated with the endpoint hosts; add, to the data structure, information identifying the network control systems associated with the endpoint hosts, and cause the threat policy action to be enforced, by one or more of the network control systems, based on the data structure, for the particular endpoint host.