Methods, systems, and apparatus, including computer programs encoded on computer storage media, for generating composite priority factors. The system automates prioritization of assets based on metrics across many dimensions, allowing security and risk managers to uses a logical framework that is scalable for thousands of assets.