A method and device for generating a monitoring policy for a device and selectively monitoring multiple tasks executed by the device is disclosed. The monitoring policy may relate to security monitoring or resource availability. A monitoring importance score for each of multiple tasks executing on the device may be generated and a monitoring resource availability within the device may be determined. The monitoring policy for the device may be generated based at least in part on the monitoring importance scores for the multiple tasks and the monitoring resource availability within the device. Fewer than all of the multiple tasks may be selectively monitored based on the monitoring policy for security threats to the device or resource availability for the device.