A system, method and computer program product for a distributed early attack warning platform (DEA WP), including a plurality of protected computer devices coupled to a first communications network; a plurality of monitoring node devices respectively coupled between the plurality of protected computer devices and the first communications network and configured to monitor data communications transmitted over the first communications network between the plurality of protected computer devices; and a second communications network separate from the first communications network coupled to the plurality of monitoring node devices. Based on the monitored data communications transmitted over the first communications network, the plurality of monitoring node devices act as a swarm configured to communicate information over the second communications network regarding potential cyber threats on the plurality of protected computer devices or the first communications network and possible countermeasures to the potential cyber threats.