A technique utilizes a security heat map associated with a geographic region. The technique involves receiving, by a server, current heat scores for one or more endpoint devices located within the geographic region. The technique further involves providing, by the server, for areas within the geographic region, respective aggregate heat scores based on the current heat scores for the one or more endpoint devices. The technique further involves, based on the respective aggregate heat scores for the areas within the geographic region, generating, by the server, a security heat map defining one or more security zones within the geographic region. The technique further involves imposing, by the server, security policies on the one or more endpoint devices based on the security heat map.