1. A method of operating an advisement system to provide security actions in a computing environment comprising a plurality of computing assets, the method comprising: identifying a security threat within the computing environment; in response to identifying the security threat, obtaining state information for the security threat within the computing environment; determining a current state for the security threat within the computing environment based on the state information; obtaining enrichment information for the security threat; and determining one or more security actions for the security threat based on the enrichment information and the current state for the security threat.