A first vulnerability that is associated with one or more nodes of a network graph that represent one or more assets of a network infrastructure may be identified. Furthermore, a second vulnerability that is associated with one or more nodes of the network graph may be identified. A determination may be made as to whether the first vulnerability or the second vulnerability contributes more to a probability of a security breach associated with the network infrastructure. A notification may be provided to mitigate the vulnerability that contributes more to the probability of the security breach associated with the network infrastructure.