1. A computer implemented method in an expert system for providing real-time response to security threats, the computer implemented method comprising: receiving data collected by monitors of a system to form received data; comparing the received data against information in a knowledge base to identify a security threat to a system resource in a form of a system event and an action for mitigating effects of the system event; comparing a threat risk of the system event to a risk of the action for mitigating the system event; if the threat risk is greater than the risk of the action, determining whether a user configured trust component is greater than the risk of the action; and responsive to determining that the trust component is greater than the risk of the action, executing the action against the security threat.