Systems, methods, and other embodiments associated with placing a virtual machine or workload on one of a plurality of hosts are described. In one embodiment, a method includes analyzing the hosts to identify a set of candidate hosts. Each candidate host is analyzed and a threat score is calculated for each candidate host that is indicative of a degree of vulnerability of the candidate host to information-security threats. The corresponding threat scores from the candidate hosts are compared and a host with a lowest threat score is selected, and the virtual machine is placed on the selected host. Thereafter, the selected host is reanalyzed to calculate an updated threat score based at least in part upon the placement of the virtual machine, and in response to determining that the updated threat score exceeds a threshold, the virtual machine is moved to a different host.