A computing system, comprising: a storage to store: information about security mitigation actions, wherein each security mitigation action is associated with a mitigation likelihood and a security event, respectively, and wherein each mitigation likelihood is a likelihood of the associated security mitigation action resolving the security event; information about an effect on device usage associated with the security mitigation actions, respectively; and a processor to: request information about planned usage of a device associated with a detected security event; select, from a set of security mitigation actions about which information is stored in the storage, a security mitigation action, and a second security mitigation action to be executed after the selected security mitigation action, wherein the selected security mitigation action is associated with limiting the effect of the security event and the second mitigation action is associated with a higher likelihood of resolving the security event; wherein the selected security mitigation action is associated with the detected security event, and wherein selecting the security mitigation action is based on information received about planned usage of the device compared to device usage effect information stored in the storage, associated with the selected security mitigation action; and cause the selected security mitigation action to be executed on the device. a storage to store: information about security mitigation actions, wherein each security mitigation action is associated with a mitigation likelihood and a security event, respectively, and wherein each mitigation likelihood is a likelihood of the associated security mitigation action resolving the security event; information about an effect on device usage associated with the security mitigation actions, respectively; and information about security mitigation actions, wherein each security mitigation action is associated with a mitigation likelihood and a security event, respectively, and wherein each mitigation likelihood is a likelihood of the associated security mitigation action resolving the security event; information about an effect on device usage associated with the security mitigation actions, respectively; and a processor to: request information about planned usage of a device associated with a detected security event; select, from a set of security mitigation actions about which information is stored in the storage, a security mitigation action, and a second security mitigation action to be executed after the selected security mitigation action, wherein the selected security mitigation action is associated with limiting the effect of the security event and the second mitigation action is associated with a higher likelihood of resolving the security event; wherein the selected security mitigation action is associated with the detected security event, and wherein selecting the security mitigation action is based on information received about planned usage of the device compared to device usage effect information stored in the storage, associated with the selected security mitigation action; and cause the selected security mitigation action to be executed on the device. request information about planned usage of a device associated with a detected security event; select, from a set of security mitigation actions about which information is stored in the storage, a security mitigation action, and a second security mitigation action to be executed after the selected security mitigation action, wherein the selected security mitigation action is associated with limiting the effect of the security event and the second mitigation action is associated with a higher likelihood of resolving the security event; wherein the selected security mitigation action is associated with the detected security event, and wherein selecting the security mitigation action is based on information received about planned usage of the device compared to device usage effect information stored in the storage, associated with the selected security mitigation action; and cause the selected security mitigation action to be executed on the device.