Patent ID: 7591002

Claim:
A method in a computing device for activating a policy having rules with conditions and actions, the method comprising: receiving a policy; installing the received policy without activation; determining by the computing device whether a policy activation criterion has been satisfied that indicates to activate the policy in either normal mode or simulation mode; when it is determined that the policy activation criterion has been satisfied to activate the policy in normal mode, activating the policy in normal mode so that when a rule of the policy is applied to a security enforcement event and the condition of the rule is satisfied, performing the action of the rule; and when it is determined that the policy activation criterion has been satisfied to activate the policy in simulation mode, activating the policy in simulation mode; when a rule of the policy activated in simulation mode is applied to a security enforcement event and the condition of the rule is satisfied, suppressing the performing of the action of the rule; and logging an indication of the security enforcement event and the rule whose condition was satisfied by the security enforcement event for evaluating effectiveness of the policy based on the logged indications; and upon receiving an indication to switch from simulation mode to normal mode based on effectiveness of the policy, activating the policy in normal mode.