1. A method of operating an advisement system to provide security actions in a computing environment comprising a plurality of assets, the method comprising: identifying a security incident for an asset in the computing environment; identifying a criticality rating for the asset; obtaining enrichment information for the security incident from one or more internal or external sources; identifying a severity rating for the security incident based on the enrichment information; determining one or more security actions based on the enrichment information; identifying effects of the one or more security actions on operations of the computing environment based on the criticality rating and the severity rating; and identifying a subset of the one or more security actions to respond to the security incident based on the effects of the one or more security actions.