Abstract: A system and method is provided for evaluating security threats to an enterprise network. The relative severities of security threats are determined, based in part, on the context of each threat within the enterprise network and in relation to the operation of a business. As a result, it is possible to prioritize security threats having the greatest magnitude and also threats that are directed against the most valuable business network devices. The invention comprises a plurality of network agents operating on a plurality of network devices for generating event messages. The event messages contain security data and are forwarded to an event manager for analysis. The event manager comprises an event correlator and an asset context manager. The event correlator detects security threats from the interrelationships between the security data contained in the event messages.