A method for orchestrating a reaction to a threat to a computing system, the computing system having access to computing resources (110, 112), the method comprising the following steps: a) providing information on a first state of said computing resources using monitoring means, the information corresponding to the state of said computing resources prior to the identification of a threat, in a memory element; b) providing a database associating at least one threat identifier, comprising a set of anomalous events (E1, E2, E3,...) being detectable on said computing resources (110, 112), with at least one corresponding reaction strategy (R1, R2), each reaction strategy comprising a structured set of control actions to be executed by said computing system, and wherein each reaction strategy is associated with a score indicating the efficiency of said reaction strategy for successfully addressing said threat; c) using detection means, detecting an anomalous event or set of anomalous events (E1', E2',...) on at least one of said computing resources (110, 112); d) selecting from said database, using selection means, at least one reaction strategy that is associated with a threat identifier at least partially matching the detected anomalous events (E1', E2',...), said reaction strategy having the highest associated score; e) scheduling, using scheduling means, the set of control actions corresponding to the selected reaction strategy to be executed by said computing system; f) providing information on a second state of said computing resources using the monitoring means, the information corresponding to the state of said computing resources (110, 112) after execution of said control actions; g1) if the second state does not substantially match the first state, associating said reaction strategy with a score indicating a low efficiency for addressing said identified threat, and repeating steps e)-f) by selecting, using said selection means, the reaction strategy being associated with the same identified threat and having the next highest associated score; g2) if the second state substantially matches the first state, associating said reaction strategy with a score indicating a high efficiency for addressing said identified threat. a) providing information on a first state of said computing resources using monitoring means, the information corresponding to the state of said computing resources prior to the identification of a threat, in a memory element; b) providing a database associating at least one threat identifier, comprising a set of anomalous events (E1, E2, E3,...) being detectable on said computing resources (110, 112), with at least one corresponding reaction strategy (R1, R2), each reaction strategy comprising a structured set of control actions to be executed by said computing system, and wherein each reaction strategy is associated with a score indicating the efficiency of said reaction strategy for successfully addressing said threat; c) using detection means, detecting an anomalous event or set of anomalous events (E1', E2',...) on at least one of said computing resources (110, 112); d) selecting from said database, using selection means, at least one reaction strategy that is associated with a threat identifier at least partially matching the detected anomalous events (E1', E2',...), said reaction strategy having the highest associated score; e) scheduling, using scheduling means, the set of control actions corresponding to the selected reaction strategy to be executed by said computing system; f) providing information on a second state of said computing resources using the monitoring means, the information corresponding to the state of said computing resources (110, 112) after execution of said control actions; g1) if the second state does not substantially match the first state, associating said reaction strategy with a score indicating a low efficiency for addressing said identified threat, and repeating steps e)-f) by selecting, using said selection means, the reaction strategy being associated with the same identified threat and having the next highest associated score; g2) if the second state substantially matches the first state, associating said reaction strategy with a score indicating a high efficiency for addressing said identified threat.