A method for automatic handling of cyber-security risk events, the method comprising: detecting , by a monitoring system , a first event associated with a device in a computing system, wherein the first event is a cyber-security risk event; in response to detecting the event, initializing a risk item corresponding to the first event, by the monitoring system , and setting the risk item to a full risk value, wherein the full risk value is a value that represents a full risk of a new event; determining , by the monitoring system , whether a second event, corresponding to the first event, has been detected, whereby the second event corresponds to the first event by being a repeat of the first event, being of a same type of event as the first event, or being generated by a same process, system, or device as the first event; in response to determining, by the monitoring system , that no second event has been detected, altering , by the monitoring system, the risk value over time, by reducing the risk value according to a decay function; in response to determining, by the monitoring system , that multiple second events corresponding to the first event have been detected, the system alters the risk value to a value higher than the full risk value; determining , by the monitoring system , if the risk value for the risk item has passed a threshold; wherein the decay function is defined as For t < P : Risk = R ∗ (1 - ( t / P )) For t >= P : Risk = 0 where Risk represents an adjusted risk value, R represents the full risk value, P represents a decay period of time, and t represents an amount of time that has passed since the first event occurred was detected; and clearing the risk item, by the monitoring system , in response to the risk value passing the threshold. detecting , by a monitoring system , a first event associated with a device in a computing system, wherein the first event is a cyber-security risk event; in response to detecting the event, initializing a risk item corresponding to the first event, by the monitoring system , and setting the risk item to a full risk value, wherein the full risk value is a value that represents a full risk of a new event; determining , by the monitoring system , whether a second event, corresponding to the first event, has been detected, whereby the second event corresponds to the first event by being a repeat of the first event, being of a same type of event as the first event, or being generated by a same process, system, or device as the first event; in response to determining, by the monitoring system , that no second event has been detected, altering , by the monitoring system, the risk value over time, by reducing the risk value according to a decay function; in response to determining, by the monitoring system , that multiple second events corresponding to the first event have been detected, the system alters the risk value to a value higher than the full risk value; determining , by the monitoring system , if the risk value for the risk item has passed a threshold; wherein the decay function is defined as For t < P : Risk = R ∗ (1 - ( t / P )) For t >= P : Risk = 0 where Risk represents an adjusted risk value, R represents the full risk value, P represents a decay period of time, and t represents an amount of time that has passed since the first event occurred was detected; and clearing the risk item, by the monitoring system , in response to the risk value passing the threshold. <EOS>