Abstract: Computer-implemented security techniques and a respective system for detecting a computer-system anomaly behavior before, during and/or after operations is described. These network-security may use instances of an agent that resides in every host-monitored computer or electronic device (such as a portable computer or a cellular telephone) and a network-security computer that is associated with an organization, and which is located on premises and/or in the cloud. Notably, the instances of the agent may monitor complicated system behavior and may report first detection of behavioral anomalies to the network-security computer. Then, the network-security computer may perform a remedial action based at least in part on the first detection of the behavioral anomalies.