1. A method comprising: establishing a security container that describes a workload and a set of resources that corresponds to the workload in a software-defined environment; determining a set of security criteria for the security container; monitoring the workload and the set of resources for security events based, at least in part, upon the set of security criteria; and responsive to identifying a security event, adjusting one or more security mechanisms; wherein: at least the steps of monitoring and adjusting are operated within the software-defined environment.