Embodiments of present disclosure provide a method and system for remotely auditing a security posture of a client machine at a centralized server. The system receives an integrity-protected report from the client machine, or other devices related to the client machine, the report comprising entries associated with security events or security states or both related to the client machine. The report entries comprise characteristics of the security events or security states to facilitate identification of a probable security attack at the client machine. The system also detects a pattern among one or more reports. Finally, the system classifies the security posture of the client machine based on the detected pattern, which could indicate a probable security attack at the client machine.