Interaction involving a computing system and/or applications accessible via the computing system is monitored. As a consequence of determining that the monitored interaction is suspicious, a security mechanism is invoked in connection with the computing system.