A security management arrangement for monitoring to detect a targeted attack on an application. Operation of the arrangement includes receiving a suspected attack alarm issued by a centralized security monitoring apparatus. The arrangement determines an application associated with the suspected attack alarm. The arrangement further operates to obtain monitoring information obtained through monitoring of the application. The arrangement further determines, based on the monitoring information, the application has been attacked.