A computing device may include a memory and a processor cooperating therewith to operate a plurality of virtual computing sessions for a plurality of client devices. Each of the virtual computing sessions may have access to a network. The processor may further operate at least one security agent configured to detect security threats from the virtual computing sessions, and a virtual management agent configured to, responsive to detection of a security threat from a given virtual computing session, discontinue access to the computing network by the given virtual computing session.