Detecting a compromised system using an integrated management controller including receiving a workload characterization for an expected hardware utilization of a computing system, wherein the workload characterization is a pattern of expected hardware utilization of computing hardware on the computing system, and wherein the workload characterization comprises hardware utilization thresholds; storing the workload characterization on an integrated management controller communicatively coupled to the computing hardware on the computing system; monitoring the computing hardware of the computing system using the integrated management controller, including comparing the hardware utilization thresholds of the workload characterization to measured hardware utilization of the computing hardware; determining that the computing system is compromised based on detecting that the measured hardware utilization of the computing hardware has exceeded one of the hardware utilization thresholds of the workload characterization; and performing a notification action in response to determining that the computing system is compromised.