Some embodiments address technical challenges arising from efforts to identify and mitigate security risks, in particular but not only, risks that sensitive data will be exfiltrated. Some embodiments provide or utilize an anomaly detector which is configured to detect a security anomaly in data based on at least a distribution of sensitive information type documents in a collection of documents and classifications of documents by trainable classifiers based on machine learning. Some embodiments provide or utilize a security policy generator which is configured to proactively and automatically generate security policy recommendations, rank at least two of the security policy recommendations, and present at least one top-ranked generated security policy recommendation in a user interface. Some embodiments generate a security policy in a managed computing system based on at least an anomaly score, and then configure the managed computing system according to the generated security policy.