In some implementations, a system receives a request to assess security risk associated with a cloud service. The system identifies, based on the request, one or more application programming interface (API) actions associated with the cloud service. The system determines respective security category information for the one or more API actions and/or respective security risk scores for the one or more API actions. The system generates, based on the respective security category information and/or the respective security risk scores, security risk mitigation information. The system causes, based on the security risk mitigation information, one or more actions to be performed. As an example, the system may send the security risk mitigation information to a device, which may allow for presentation of the security risk mitigation information or implementation of code that is included in the security risk mitigation information.