A method for automatic handling of cyber-security risk events, the method comprising: detecting, by a monitoring system, a first event associated with a device in a computing system, wherein the first event is a cyber-security risk event; in response to detecting the event, initializing a risk item corresponding to the first event, by the monitoring system, and setting the risk item to a full risk value, wherein the full risk value is a value that represents a full risk of a new event; determining, by the monitoring system, whether a second event, corresponding to the first event, has been detected, whereby the second event corresponds to the first event by being a repeat of the first event, being of a same type of event as the first event, or being generated by a same process, system, or device as the first event; in response to determining, by the monitoring system, that no second event has been detected, altering, by the monitoring system, the risk value over time, by reducing the risk value according to a decay function; in response to determining, by the monitoring system, that multiple second events corresponding to the first event have been detected, the system alters the risk value to a value higher than the full risk value; determining, by the monitoring system, if the risk value for the risk item has passed a threshold; wherein the decay function is defined as For t < P: Risk = R ∗ (1 - ( t / P)) For t >= P: Risk = 0 where Risk represents an adjusted risk value, R represents the full risk value, P represents a decay period of time, and t represents an amount of time that has passed since the first event occurred was detected; and clearing the risk item, by the monitoring system, in response to the risk value passing the threshold. detecting, by a monitoring system, a first event associated with a device in a computing system, wherein the first event is a cyber-security risk event; in response to detecting the event, initializing a risk item corresponding to the first event, by the monitoring system, and setting the risk item to a full risk value, wherein the full risk value is a value that represents a full risk of a new event; determining, by the monitoring system, whether a second event, corresponding to the first event, has been detected, whereby the second event corresponds to the first event by being a repeat of the first event, being of a same type of event as the first event, or being generated by a same process, system, or device as the first event; in response to determining, by the monitoring system, that no second event has been detected, altering, by the monitoring system, the risk value over time, by reducing the risk value according to a decay function; in response to determining, by the monitoring system, that multiple second events corresponding to the first event have been detected, the system alters the risk value to a value higher than the full risk value; determining, by the monitoring system, if the risk value for the risk item has passed a threshold; wherein the decay function is defined as For t < P: Risk = R ∗ (1 - ( t / P)) For t >= P: Risk = 0 where Risk represents an adjusted risk value, R represents the full risk value, P represents a decay period of time, and t represents an amount of time that has passed since the first event occurred was detected; and clearing the risk item, by the monitoring system, in response to the risk value passing the threshold.