A first device governs operation of a second device based on a network security risk posed by the second device. The second device is disposed locally to the first device and in local network communication with the first device. The first device is in network communication with a cloud-based computational service.