Abstract: A system and method for managing security incidents in a computing environment uses adaptive feedback to update security procedures in response to detected security incidents. Accordingly, the system and method is capable of defining security procedures, which can include one or more policies, and implementing these security procedures on one or more computing systems in the computing environment. The system and method monitors activities in the environment and detects security incidents using the implemented security procedures. When a security incident is detected, the security procedures are updated in response to said detected security incident and implemented on one or more systems in the computing environment.