A security system for managing security risks for a plurality of organisations, said security system comprising: an intrusion detection system for detecting intrusion attempts and/or attacks that have taken place at one or more of the plurality of organisations that are connected to the intrusion detection system by a network, and that could compromise the security of data, property and/or individuals of said organisation(s), said intrusion detection system having means for sending a signal comprising data relevant to the detected intrusion attempts and/or attacks via the network to a threat intelligence system; the threat intelligence system being connected to the network and having means for receiving the signals sent by the intrusion detection system and means for storing the received data, said threat intelligence system further comprising a means for recording and storing data relevant to intrusion attempts and attacks other than those detected by the intrusion detection system; one or more threat vulnerability intelligence systems, each for a particular one or a particular subset of organisations connected to the network, each threat vulnerability intelligence system arranged for storing data relating to intrusion attempts and/or attacks that are potentially relevant to said particular one or more organisations, the relevance of each said intrusion attempt and/or attack being indicated by a weight value and/or importance value; one or more correlation engines connected to the network for analysing the data in the threat intelligence system and said one or more threat vulnerability intelligence systems to identify one or more correlations in the intrusion attempts and/or attacks by determining if an intrusion attempt/attack in the threat intelligence system is indicated in the one or more threat vulnerability intelligence systems; each correlation engine arranged to send a notification of an identified correlation to a security risk management system of the particular one or more organisation(s) to which the correlation relates to, wherein the notification is sent only if the weight value and/or importance value corresponds to or exceeds a predetermined value. an intrusion detection system for detecting intrusion attempts and/or attacks that have taken place at one or more of the plurality of organisations that are connected to the intrusion detection system by a network, and that could compromise the security of data, property and/or individuals of said organisation(s), said intrusion detection system having means for sending a signal comprising data relevant to the detected intrusion attempts and/or attacks via the network to a threat intelligence system; the threat intelligence system being connected to the network and having means for receiving the signals sent by the intrusion detection system and means for storing the received data, said threat intelligence system further comprising a means for recording and storing data relevant to intrusion attempts and attacks other than those detected by the intrusion detection system; one or more threat vulnerability intelligence systems, each for a particular one or a particular subset of organisations connected to the network, each threat vulnerability intelligence system arranged for storing data relating to intrusion attempts and/or attacks that are potentially relevant to said particular one or more organisations, the relevance of each said intrusion attempt and/or attack being indicated by a weight value and/or importance value; one or more correlation engines connected to the network for analysing the data in the threat intelligence system and said one or more threat vulnerability intelligence systems to identify one or more correlations in the intrusion attempts and/or attacks by determining if an intrusion attempt/attack in the threat intelligence system is indicated in the one or more threat vulnerability intelligence systems; each correlation engine arranged to send a notification of an identified correlation to a security risk management system of the particular one or more organisation(s) to which the correlation relates to, wherein the notification is sent only if the weight value and/or importance value corresponds to or exceeds a predetermined value.