1. A method for managing risk to an organization associated with each of a plurality of virtual machines (VMs) each running on one of a plurality of hosts, each host being a physical computer system connected to one or more networks and in communication with a risk orchestrator for carrying out the method, the risk orchestrator being an application in communication with the plurality of hosts and a threat indicator, the method comprising: receiving at the risk orchestrator a threat indication message from the threat indicator, the threat indication message indicating a status of a threat to which a plurality of hosts in a threat group are vulnerable; calculating a downtime probability resulting from the threat; calculating a host downtime probability for each host, the host downtime probability being a function of all the downtime probabilities from all threats for which the host is vulnerable; for each risk-managed VM, calculating a risk value associated with the VM, the risk value being a function of the host downtime probability for the host on which the VM is running and an impact value for the VM, the impact value being a value reflecting a relative importance of the VM to the organization; identifying each risk-managed VM requiring risk mitigation, the identifying being in accordance with a policy, prioritizing the risk-managed VMs requiring risk mitigation in an order starting with one of the risk-managed VMs having a highest associated risk; performing a configured mitigation control action on each of the risk-managed VMs requiring risk mitigation, in the order of the prioritization.