Security issues of cloud computing are always being concerned by customers. Research on a virtual machine’s quantitative or qualitative value of risk will be a good start to know the security status of a cloud data center. Risk assessment is a solution for really understanding security procedures of the network and information system, analyzing where security threats come from and how much loss the risk can cause. By means of the combination of risk assessment with cloud computing, we can assess the risk value of virtual machines, and the security of data center can be ensured by administrator who has ability to quickly locate the risk points and easily control and reduce the risks. In this paper, we present VMRaS (a novel virtual machine risk assessment scheme in the cloud environment), a scheme that can assess the risk of a virtual machine. First, we introduce the process, criteria and algorithms of risk assessment. And then we present the design and implementation of VMRaS. We evaluate a prototype of VMRaS which is deployed on an OpenStack-based cloud computing resource management platform. The result shows that VMRaS works well in the OpenStack-based cloud environment.