1. A method of providing computer security on a computer system, the method comprising: defining at least one key event to be monitored by at least one agent; creating a graphical model for the at least one key event; observing the at least one key event; inferring a degree of attack on the computer system based on an observation of the at least one key event in conjunction with a result of an effect the at least one key event has on the graphical model; and adjusting a security policy based on an output of the graphical model.