Automated and adaptive model-driven security system and method for operating the same

A method of managing implementation of risk-based policies in an information technologies system, the method comprising:

• receiving into a processor at least one risk policy function stored in at least one memory;
• receiving into the processor at least one alert stored in the at least one memory;
• based on a received input, automatically or semi-automatically generating via the processor a risk level calculation, a machine-enforceable rule and/or configuration, and an action, by
• applying at least calculation function to calculate the level of matching between
• at least one first alert, functional or non functional values specified in the risk policy function that indicate a resulting risk level, and
• at least one second alert values comprised in the alerts;
• the machine-enforceable rule and/or configuration including at least one response action specified in the risk policy function;
• and
• distributing, via the processor, the machine-enforceable rule and/or configuration to the at least one memory of the IT system or another at least one memory to thereby enable implementation of the policies.