1. A method comprising: discovering multiple devices in a computing system by a risk manager system; grouping the multiple devices into multiple security zones by the risk manager system; generating a risk value identifying at least one cyber-security risk of the devices for one of the security zones by the risk manager system; comparing the risk value to a threshold by the risk manager system; and automatically generating a notification for one or more users by the risk manager system when the risk value violates the threshold.