1. A computer implemented method for network intrusion management, the method comprising: monitoring, by an intrusion management system, a set of nodes of a computer network; determining, by the intrusion management system, a node workload for the set of nodes; classifying, by the intrusion management system, in response to detecting a network intrusion related to the set of nodes, an intrusion signature for the network intrusion; determining, by the intrusion management system, a response for managing a security vulnerability of the set of nodes based on the node workload and the intrusion signature; and instantiating, by the intrusion management system, the response to the set of nodes; wherein determining the response includes: determining a protocol or an application targeted by the network intrusion; and determining that the protocol or the application targeted by the network intrusion is not active at the time of the network intrusion based on the node workload; wherein the response includes deferring application of a security patch for the network intrusion based on determining that the protocol or the application targeted by the network intrusion is not active at the time of the network intrusion.