According to an example aspect of the present invention, there is provided a method comprising compiling a behavioural baseline database comprising system call behaviours of a computer program, using a first testing process based at least partly on emulated nodes, running a second test of the computer program using live nodes and logging system call behaviour of the computer program during the second test, and determining whether the system call behaviour logged during the second test comprises behaviour deviates from the behavioural baseline database.