A cybersecurity system and method utilizing SOUND reputation, where a set of reputations are associated with each actor on a network. The actors on a network may be users, hosts, applications, and the like. The associated reputations are aggregated and updated as new information about an actor's activity is reported according to a defined and modifiable protocol, or policy. The actor's activity may be reported by one or more threat sensors. The effect of a particular misbehavior can be tuned to match the needs of the specific network. When a bad actor's reputation sinks too low, the system can take whatever action is appropriate: reports can be sent, an operator can be notified, the offender can be cut off from the network, or the like.