A system includes a computing cloud comprising at least one data storage unit and at least one processing unit. The computing cloud is configured to connect to at least one client and monitor the traffic of the at least one client. The computing cloud is further configured to determine an operational mode of the client, compare the monitored traffic with an anticipated traffic pattern associated with the operational mode, and determine if a security threat is indicated based on the comparison.