A computer implemented malware protection method to protect at least a subset of a set of computer systems from a malware propagating through the set of computer systems, the method comprising: accessing a model of the set of computer systems, the model identifying computer systems in the set and interactions therebetween based on previous communication occurring between the computer systems, each interaction being identified for an interacting pair of computer systems, wherein each computer system is identified by the model as having an indication of a state of malware infection as one of susceptible to infection by the malware and infected by the malware; simulating, over a plurality of time periods, a propagation of the malware from infected computer systems to susceptible computer systems, the simulation being based on a number of interactions per time period between each interacting pair of computer systems in the set, and a rate of transmission of the malware per interaction; responsive to the simulating step, identifying one or more computer systems or interacting pairs of computer systems for the deployment of a malware protection measure thereto so as to inhibit a propagation of the malware through the set of computer systems, wherein the rate of transmission of the malware per interaction is determined based on a set of temporal historical interaction data identifying interactions between pairs of computer systems in the model during each of a plurality of historical time periods, the rate of transmission being determined by modelling probabilities of transmission of the malware between interacting pairs of computer systems in the temporal historical interaction data. accessing a model of the set of computer systems, the model identifying computer systems in the set and interactions therebetween based on previous communication occurring between the computer systems, each interaction being identified for an interacting pair of computer systems, wherein each computer system is identified by the model as having an indication of a state of malware infection as one of susceptible to infection by the malware and infected by the malware; simulating, over a plurality of time periods, a propagation of the malware from infected computer systems to susceptible computer systems, the simulation being based on a number of interactions per time period between each interacting pair of computer systems in the set, and a rate of transmission of the malware per interaction; responsive to the simulating step, identifying one or more computer systems or interacting pairs of computer systems for the deployment of a malware protection measure thereto so as to inhibit a propagation of the malware through the set of computer systems, wherein the rate of transmission of the malware per interaction is determined based on a set of temporal historical interaction data identifying interactions between pairs of computer systems in the model during each of a plurality of historical time periods, the rate of transmission being determined by modelling probabilities of transmission of the malware between interacting pairs of computer systems in the temporal historical interaction data.