A computer-implemented method for protecting computing resources based on logical data models may include (1) receiving, from a security agent, log data that specifies details of a security event detected by the security agent, (2) creating an instance of a data structure for a logical data model that describes a path cycle of a security threat, (3) populating at least one field of the data structure for the logical data model with a completed value, (4) populating at least one other field of the data structure for the logical data model with a value of incomplete based on a completed value for the other field being unavailable, and (5) performing a security action based on an analysis of the instance of the data structure for the logical data model. Various other methods, systems, and computer-readable media are also disclosed.