A system to perform computer security threat analysis, comprising: a processor, configured to execute computer executable instructions; a memory, communicatively coupled with the processor; a computer readable medium, communicatively coupled with the processor; a data storage structure, resident in the computer readable medium configured to store: a plurality of attack surface instances, a plurality of attack vector instances, each attack vector instance configured to store an association to one or more attack surface instances, a plurality of threat model instances, a plurality of associations between attack surface instances and threat model instances, indicator data associated with at least one attack vector or at least one attack surface, the indicator data describing events that indicate a change in the likelihood of the associated attack vector or attack surface occurring, and response data associated with at least one attack vector or at least one attack surface, the response data describing procedures to remediate the associated at least one attack vector or at least one attack surface; a software query component resident in the memory and communicatively coupled to the data storage structure; and a software similarity component communicatively coupled to the software query component, wherein the software query component is configured to receive data of an observed event, search the data storage structure for the observed event and identify at least some of the indicator data stored in the data storage structure based on a similarity score between the events described by the indicator data and the received observed event, which similarity score is calculated by the software similarity component, wherein the software query component is further configured to return response data from the data storage structure based at least on the identified indicator data. a processor, configured to execute computer executable instructions; a memory, communicatively coupled with the processor; a computer readable medium, communicatively coupled with the processor; a data storage structure, resident in the computer readable medium configured to store: a plurality of attack surface instances, a plurality of attack vector instances, each attack vector instance configured to store an association to one or more attack surface instances, a plurality of threat model instances, a plurality of associations between attack surface instances and threat model instances, indicator data associated with at least one attack vector or at least one attack surface, the indicator data describing events that indicate a change in the likelihood of the associated attack vector or attack surface occurring, and response data associated with at least one attack vector or at least one attack surface, the response data describing procedures to remediate the associated at least one attack vector or at least one attack surface; a plurality of attack surface instances, a plurality of attack vector instances, each attack vector instance configured to store an association to one or more attack surface instances, a plurality of threat model instances, a plurality of associations between attack surface instances and threat model instances, indicator data associated with at least one attack vector or at least one attack surface, the indicator data describing events that indicate a change in the likelihood of the associated attack vector or attack surface occurring, and response data associated with at least one attack vector or at least one attack surface, the response data describing procedures to remediate the associated at least one attack vector or at least one attack surface; a software query component resident in the memory and communicatively coupled to the data storage structure; and a software similarity component communicatively coupled to the software query component, wherein the software query component is configured to receive data of an observed event, search the data storage structure for the observed event and identify at least some of the indicator data stored in the data storage structure based on a similarity score between the events described by the indicator data and the received observed event, which similarity score is calculated by the software similarity component, wherein the software query component is further configured to return response data from the data storage structure based at least on the identified indicator data.