Abstract: In one or more examples disclosed herein, a potential cyberattack is detected in a centralized computer system. A centralized policy service generates a prevention policy in response, using the information about the potential cyberattack. The prevention policy allows granular blocking of selective functionality in respect of a certain user(s). Although generated centrally, one generated, the prevention policy is distributed to multiple computer devices (e.g. within an organization) for decentralized enforcement, by policy agents executed on those computer devices.