Systems and methods for detecting security blind spots

1. A computer-implemented method for detecting security blind spots, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

detecting, via an endpoint security program, a threat incident at a set of client machines associated with a security vendor server;

obtaining an indication of how the set of client machines will respond to the detecting of the threat incident;

predicting how a model set of client machines would respond to the threat incident by applying a feature vector that describes the threat incident to a trained supervised machine learning function that predicts how the model set of client machines would respond to threat incidents based on training data that labels actual previous responses by the model set of client machines to previous threat incidents;

determining that a delta exceeds a security threshold, the delta indicating a difference between the obtained indication of how the set of client machines will respond to the detecting of the threat incident and the prediction of how the model set of client machines would respond to the threat incident; and

performing a security action by the security vendor server, in response to determining that the delta exceeds the security threshold, to protect the set of client machines at least in part by electronically notifying the set of client machines of information about the prediction of how the model set of client machines would respond to the threat incident.

2. The computer-implemented method of claim 1 , wherein obtaining the indication of how the set of client machines will respond to the detecting of the threat incident comprises receiving an indication of an actual previous response by the set of client machines.

3. The computer-implemented method of claim 1 , wherein obtaining the indication of how the set of client machines will respond to the detecting of the threat incident comprises applying the feature vector that describes the threat incident to a trained supervised machine learning function that predicts how the set of client machines would respond to threat incidents based on training data that labels actual previous responses by the set of client machines to previous threat incidents.

4. The computer-implemented method of claim 1 , wherein:

the set of client machines corresponds to one customer of a security vendor that manages the security vendor server; and

the security vendor selected the model set of client machines from customers of the security vendor.

5. The computer-implemented method of claim 1 , wherein the model set of client machines are selected, from among a larger set of client machines associated with the security vendor server, based on a level of engagement with a security system provided by the security vendor server.

6. The computer-implemented method of claim 1 , wherein the model set of client machines are selected, from among a larger set of client machines associated with the security vendor server, based on a calculated degree of similarity to the set of client machines for which the indication is obtained.

7. The computer-implemented method of claim 1 , wherein the model set of client machines are selected, from among a larger set of client machines associated with the security vendor server, based on a relative security score that indicates a relative degree of security hygiene of the model set of client machines in comparison to other client machines in the larger set.

8. The computer-implemented method of claim 1 , wherein electronically notifying the set of client machines of information about the prediction of how the model set of client machines would respond to the threat incident comprises electronically notifying the set of client machines that the set of client machines is currently ignoring the threat incident even though other client machines in the model set of client machines addressed parallel instances of the threat incident.

9. The computer-implemented method of claim 1 , wherein electronically notifying the set of client machines of information about the prediction of how the model set of client machines would respond to the threat incident comprises electronically notifying the set of client machines that the threat incident leads to a specific negative security outcome identified through the training data.

10. The computer-implemented method of claim 1 , wherein electronically notifying the set of client machines of information about the prediction of how the model set of client machines would respond to the threat incident comprises electronically notifying the set of client machines about further contextual information about other instances of the threat incident identified through the training data.

11. A system for detecting security blind spots, the system comprising:

a detection module, stored in memory, that detects, via an endpoint security program, a threat incident at a set of client machines associated with a security vendor server;

an obtaining module, stored in memory, that obtains an indication of how the set of client machines will respond to the detecting of the threat incident;

a prediction module, stored in memory, that predicts how a model set of client machines would respond to the threat incident by applying a feature vector that describes the threat incident to a trained supervised machine learning function that predicts how the model set of client machines would respond to threat incidents based on training data that labels actual previous responses by the model set of client machines to previous threat incidents;

a determination module, stored in memory, that determines that a delta exceeds a security threshold, the delta indicating a difference between the obtained indication of how the set of client machines will respond to the detecting of the threat incident and the prediction of how the model set of client machines would respond to the threat incident;

a performance module, stored in memory as part of the security vendor server, that performs a security action, in response to determining that the delta exceeds the security threshold, to protect the set of client machines at least in part by electronically notifying the set of client machines of information about the prediction of how the model set of client machines would respond to the threat incident; and

at least one physical processor configured to execute the detection module, the obtaining module, the prediction module, the determination module, and the performance module.

12. The system of claim 11 , wherein the obtaining module obtains the indication of how the set of client machines will respond to the detecting of the threat incident by receiving an indication of an actual previous response by the set of client machines.

13. The system of claim 11 , wherein the obtaining module obtains the indication of how the set of client machines will respond to the detecting of the threat incident by applying the feature vector that describes the threat incident to a trained supervised machine learning function that predicts how the set of client machines would respond to threat incidents based on training data that labels actual previous responses by the set of client machines to previous threat incidents.

14. The system of claim 11 , wherein:

the set of client machines corresponds to one customer of a security vendor that manages the security vendor server; and

the prediction module selects the model set of client machines from customers of the security vendor.

15. The system of claim 11 , wherein the prediction module selects the model set of client machines, from among a larger set of client machines associated with the security vendor server, based on a level of engagement with the system provided by the security vendor server.

16. The system of claim 11 , wherein the prediction module selects the model set of client machines, from among a larger set of client machines associated with the security vendor server, based on a calculated degree of similarity to the set of client machines for which the indication is obtained.

17. The system of claim 11 , wherein the prediction module selects the model set of client machines, from among a larger set of client machines associated with the security vendor server, based on a relative security score that indicates a relative degree of security hygiene of the model set of client machines in comparison to other client machines in the larger set.

18. The system of claim 11 , wherein the performance module electronically notifies the set of client machines of information about the prediction of how the model set of client machines would respond to the threat incident at least in part by electronically notifying the set of client machines that the set of client machines is currently ignoring the threat incident even though other client machines in the model set of client machines addressed parallel instances of the threat incident.

19. The system of claim 11 , wherein the performance module electronically notifies the set of client machines of information about the prediction of how the model set of client machines would respond to the threat incident at least in part by electronically notifying the set of client machines that the threat incident leads to a specific negative security outcome identified through the training data.

20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

detect, via an endpoint security program, a threat incident at a set of client machines associated with a security vendor server;

obtain an indication of how the set of client machines will respond to the detecting of the threat incident;

predict how a model set of client machines would respond to the threat incident by applying a feature vector that describes the threat incident to a trained supervised machine learning function that predicts how the model set of client machines would respond to threat incidents based on training data that labels actual previous responses by the model set of client machines to previous threat incidents;

determine that a delta exceeds a security threshold, the delta indicating a difference between the obtained indication of how the set of client machines will respond to the detecting of the threat incident and the prediction of how the model set of client machines would respond to the threat incident; and

perform a security action, in response to determining that the delta exceeds the security threshold, to protect the set of client machines at least in part by electronically notifying the set of client machines of information about the prediction of how the model set of client machines would respond to the threat incident.