A computerized method comprising: by a computing device having one or more computer processors and a non-transitory computer readable storage device storing software instruction for execution by the one or more computer processors, obtaining information describing network traffic between a plurality of network devices within a network determining, based on the information describing network traffic, a network topology of the network, the network topology comprising a plurality of nodes (122A-122E) each connected by an edge to one or more of the plurality of nodes, wherein each node is associated with one or more network devices, and wherein the network topology is associated with user account access information of a plurality of user accounts identifying actual access attempts to respective nodes in the network in a period of time; determining, for each of the plurality of user accounts, a compromise risk value associated with the user account, the compromise risk value being based on: user account access information of the user account to nodes included in the network topology, and information indicating a likelihood of the user account being compromised; and generating a user interface including indications of user accounts sorted according to compromise risk value, wherein the generated user interface identifies a graph that identifies the network topology, wherein the generated user interface is configured to receive a selection of a user account and to update the graph with particular nodes the particular user account has accessed in a previous time period. by a computing device having one or more computer processors and a non-transitory computer readable storage device storing software instruction for execution by the one or more computer processors, obtaining information describing network traffic between a plurality of network devices within a network determining, based on the information describing network traffic, a network topology of the network, the network topology comprising a plurality of nodes (122A-122E) each connected by an edge to one or more of the plurality of nodes, wherein each node is associated with one or more network devices, and wherein the network topology is associated with user account access information of a plurality of user accounts identifying actual access attempts to respective nodes in the network in a period of time; determining, for each of the plurality of user accounts, a compromise risk value associated with the user account, the compromise risk value being based on: user account access information of the user account to nodes included in the network topology, and information indicating a likelihood of the user account being compromised; and user account access information of the user account to nodes included in the network topology, and information indicating a likelihood of the user account being compromised; and generating a user interface including indications of user accounts sorted according to compromise risk value, wherein the generated user interface identifies a graph that identifies the network topology, wherein the generated user interface is configured to receive a selection of a user account and to update the graph with particular nodes the particular user account has accessed in a previous time period.