Abstract: Various aspects of the disclosure relate to automated monitoring and remediation of computing threats at an endpoint computing device. An endpoint monitoring tool is configured to monitor for security threats on the local host computing device. An identified threat causes the endpoint monitoring tool to automatically quarantine the local device and any associated user accounts. During a pre-defined time period the endpoint monitoring tool analyzes an impact of the threat and any user activities from the time a suspect file was created. The endpoint monitoring tool attempts to automatically mitigate the security threat during the pre-defined time period. If the threat was cleared, the local computing device and the user accounts are released for normal use. If the threat was unable to be cleared within the time period, additional mitigation processes are triggered.