A computing device monitors for an event trigger by a secure computing module. Based on identifying an event trigger at the computing device, the secure computing module executes a health check according to a configuration identifying operating anomalies that are indicative of malicious activity at the computing device. The health check includes scanning a filesystem and communications module operation and configuration of the computing device for indications of malicious activity. Based on identified operating anomalies at the computing device, the secure computing module determines response measures to secure the computing device. The secure computing module executes the response measures individually or in combination at the computing device based on a response configuration.