Abstract: A computer network security system utilizes mobile sensor agents that detect host-level activities and report event occurrences to a security server connected to the protected network. The security server processes the event data, assesses the current situation/risk status of the network, and manages the distribution of mobile sensor agents in the network in response to the current status of the network. The security server employs intelligent data fusion techniques to obtain contextually relevant situation/risk data based upon the relatively abstract host-level activity data. The security server can deploy additional mobile sensor agents to monitor for specific events, withdraw active mobile sensor agents installed on client computers, move mobile sensor agents within the protected network, and perform other managerial and regulatory actions that govern the mobile sensor agents.