A system for assigning a security risk score to a resource, comprising: at least one processor circuit; and at least one memory that stores program code configured to be executed by the at least one processor circuit, the program code comprising: a data risk index, DRI, score generator configured to collect (202; 320) resource access data for a resource (104A-104N), the resource being data that is stored within a storage, wherein the resource access data comprises permissions for each of a plurality of identities to perform an action on the resource; and generate a DRI score for the resource based at least on the resource access data, the DRI score indicative of a level of risk that the resource will be compromised, whereby for each identity with access to a resource, a security-incident probability is determined based on a base probability and an effective threat count, whereby the effective threat count is taken into account in an exponent, whereby the effective threat count reflects the level of risk, and wherein the effective threat count for the identity is determined based on a base threat value and a function of the number of unused granted actions for the identity; and a DRI reporter configured to report (206; 328), to an administrator, at least: the DRI score; an alert based at least on the DRI score; and a policy change for the resource based at least on the DRI score, wherein the administrator comprises automated software that consumes the generated information. at least one processor circuit; and at least one memory that stores program code configured to be executed by the at least one processor circuit, the program code comprising: a data risk index, DRI, score generator configured to collect (202; 320) resource access data for a resource (104A-104N), the resource being data that is stored within a storage, wherein the resource access data comprises permissions for each of a plurality of identities to perform an action on the resource; and generate a DRI score for the resource based at least on the resource access data, the DRI score indicative of a level of risk that the resource will be compromised, whereby for each identity with access to a resource, a security-incident probability is determined based on a base probability and an effective threat count, whereby the effective threat count is taken into account in an exponent, whereby the effective threat count reflects the level of risk, and wherein the effective threat count for the identity is determined based on a base threat value and a function of the number of unused granted actions for the identity; and a DRI reporter configured to report (206; 328), to an administrator, at least: the DRI score; an alert based at least on the DRI score; and a policy change for the resource based at least on the DRI score, wherein the administrator comprises automated software that consumes the generated information. a data risk index, DRI, score generator configured to collect (202; 320) resource access data for a resource (104A-104N), the resource being data that is stored within a storage, wherein the resource access data comprises permissions for each of a plurality of identities to perform an action on the resource; and generate a DRI score for the resource based at least on the resource access data, the DRI score indicative of a level of risk that the resource will be compromised, whereby for each identity with access to a resource, a security-incident probability is determined based on a base probability and an effective threat count, whereby the effective threat count is taken into account in an exponent, whereby the effective threat count reflects the level of risk, and wherein the effective threat count for the identity is determined based on a base threat value and a function of the number of unused granted actions for the identity; and a DRI reporter configured to report (206; 328), to an administrator, at least: the DRI score; an alert based at least on the DRI score; and a policy change for the resource based at least on the DRI score, wherein the administrator comprises automated software that consumes the generated information. the DRI score; an alert based at least on the DRI score; and a policy change for the resource based at least on the DRI score, wherein the administrator comprises automated software that consumes the generated information.