Edge security is disclosed. Hosts included in a distributed infrastructure are equipped with data processing units that may be centrally managed using a control plane. Security policies can be selectively distributed to the hosts and localized at the hosts. Reactions to security violations can be initiated at the hosts in substantially real-time. The security policies may take various forms, including rule-based security policies and inference mode-based security policies.