1. A method comprising, by a computer system comprising a processing unit, wherein the processing unit is operable to implement the method: monitoring, by a file-system auditing component comprising a computer server, file-system events of a file system for risk-assessment events; responsive to a real-time determination of at least one risk-assessment event: determining an age of a file-system object associated with the risk-assessment event, wherein the age comprises at least one of a creation date of the file-system object and a time elapsed since the creation date; counting a number of individual users who have permission to access the file-system object; measuring a depth of the file-system object in the file system; determining, by an exposure-assessment module comprising a computer server, a content-independent risk of exposure of the file-system object; wherein the content-independent risk of exposure is determined as a function of at least the determined age, the counted number of individual users and the measured depth; wherein the content-independent risk of exposure increases in response to a greater determined age of the file-system object, a greater counted number of individual users who have permission to access the file-system object, and lesser values of the measured depth of the file-system object; and wherein the determining the content-independent risk of exposure is performed without scanning data within the file system for sensitive information.