Abstract: A software threat analysis, detection and containment system includes a data aggregation model that receives and aggregates data from a plurality of sources in a computer network, a classification engine that classifies the aggregated data, and a plurality of data sets into which the classified data is stored. A model creation engine creates threat models based on the content of each data set and a prediction and analysis engine generates actionable information and predictions based on the content of each threat model.