A method and system comprising a network gateway for monitoring a network traffic between a network client and the network gateway, and at least one network client connected to said network gateway and comprising means for applying host-based protection measures are provided, wherein the network gateway evaluates the monitored traffic for indications of undesired behaviour and has control of the means for applying host-based protection measures of the at least one network client. Optionally network-based protection measures activated at the network gateway may be combined with the host-based protection measures and/or suspicious device events observed at the network client may be accounted for when assessing suitable protection measures in addition to the traffic monitored at the network gateway.