A system comprising: a security enforcement point device disposed within a managed network, wherein the security enforcement point device applies security policies to protect computing devices on the managed network from security threats; and a security decision point device disposed within a computational instance of a remote network management platform, wherein the remote network management platform is a network platform that is outside of the managed network, wherein the computational instance is dedicated to serving the managed network, and wherein the security decision point device is configured to: receive a message by way of the managed network, wherein the message was obtained by a particular computing device of the computing devices, parse the message to identify observable indicators of one or more of the security threats, wherein the observable indicators include at least one of a network address, a hyperlink, or a representation of an attached file, remotely query a security threat database to determine whether the observable indicators match one or more feature vectors associated with respective security threats, receive, from the security threat database, an indication that the observable indicators are not associated with any of the security threats, and transmit, to the security enforcement point device, a command to update a security policy in order to improve its classification capabilities when applied to future messages received at the security enforcement point device and that have the observable indicators, such that the future messages having the observable indicators are scored to be classified, with higher probability, as spam at the security enforcement point device and such that the said future messages are not to be forwarded to the security decision point device. a security enforcement point device disposed within a managed network, wherein the security enforcement point device applies security policies to protect computing devices on the managed network from security threats; and a security decision point device disposed within a computational instance of a remote network management platform, wherein the remote network management platform is a network platform that is outside of the managed network, wherein the computational instance is dedicated to serving the managed network, and wherein the security decision point device is configured to: receive a message by way of the managed network, wherein the message was obtained by a particular computing device of the computing devices, parse the message to identify observable indicators of one or more of the security threats, wherein the observable indicators include at least one of a network address, a hyperlink, or a representation of an attached file, remotely query a security threat database to determine whether the observable indicators match one or more feature vectors associated with respective security threats, receive, from the security threat database, an indication that the observable indicators are not associated with any of the security threats, and transmit, to the security enforcement point device, a command to update a security policy in order to improve its classification capabilities when applied to future messages received at the security enforcement point device and that have the observable indicators, such that the future messages having the observable indicators are scored to be classified, with higher probability, as spam at the security enforcement point device and such that the said future messages are not to be forwarded to the security decision point device. receive a message by way of the managed network, wherein the message was obtained by a particular computing device of the computing devices, parse the message to identify observable indicators of one or more of the security threats, wherein the observable indicators include at least one of a network address, a hyperlink, or a representation of an attached file, remotely query a security threat database to determine whether the observable indicators match one or more feature vectors associated with respective security threats,