1. A method of determining a security threat comprising: storing security events ( 501 ) associated with network devices; storing an actor category model ( 503 ) including a plurality of levels arranged in a hierarchy and each level is associated with a subcategory for a category of the model; correlating security events ( 505 ) with the actor category model; and determining, by a computer system, whether the security threat exists ( 506 ) based on the correlating.