Toxic combinations: when small signals add up to a security incident