Adaptive actions for responding to security risks in computer networks

System and method for taking actions to mitigate security risks in a computer network are disclosed. The costs of security events and taking actions to block permissions granted to users are defined. For each of the users, prediction models are created, one for each of the security events. Using prediction models of a selected user, predictions on whether the security events will occur and/or predictions of severity if the security events actually occur are generated. For the selected user, an action list that indicates whether or not to take actions to block particular permissions granted to the selected user is generated based at least on the predictions, costs of the events, and costs of the permissions.