1. A computer implemented method for determining a security policy based on execution of application code, comprising logging execution data for an application; creating a security policy based on one or more security related events of the application from the logged execution data; and determining whether an existing security policy matches the security policy, if yes, suggest the matching existing security policy for the application; if not, suggesting a custom security policy for the application;