1. A method for simulation aided security event management, the method comprises: generating and storing attack simulation information that comprises multiple simulation data items of at least one data item type out of vulnerability instances data items, attack step data items and attack simulation scope data items; wherein the generating of the attack simulation information is responsive to a network model, at least one attack starting point and attack action information; identifying security events in response to a correlation between simulation data items and event data; determining a confidence level for each of the identified security events; prioritizing the identified security events that have a confidence level that is above a confidence threshold while ignoring the identified security events that have a confidence level that is below the confidence threshold.