1. A method in a computer system for enforcing a security policy, the method comprising: providing detection criteria available for the security policy, the detection criteria being provided by a developer and being developer signatures specifying how to detect an attempted exploitation of a vulnerability of a software system; providing developer rules of the security policy, the developer rules being developed by the developer, a developer rule specifying a condition and an action, the condition of a developer rule specifying a developer signature; defining by a user custom rules for the security policy, a custom rule specifying a condition and an action, the condition of a custom rule specifying a developer signature; and when a security event occurs, evaluating the conditions of the developer rules and the custom rules, the evaluating including evaluating the provided detection criterion specified by the rule; and when the evaluation of the condition indicates to perform the action, performing the action of the rule wherein the custom rules can take advantage of the detection criteria developed by the developer and the provided detection criteria can be modified by the developer and distributed to the user without having to modify previously defined custom rules.