Abstract: A security architecture has an event analysis engine that acquires several tangible actions. The occur in an action space of an organization, and relate to unauthorized access to assets and reproduction of information. The event analysis engine evaluates the acquired actions based on the information stored in the database and in the context of past actions which have occurred, and determines a suitable response to the acquired action based on the evaluation.