An apparatus for reducing a security risk in a networked computer system architecture, comprising: a processor; a network interface comprising a communications port connected to a network; a memory accessible by the processor and comprising a security risk module that comprises instructions executable by the processor; a configuration management database, CMDB, that comprises a plurality of configuration item records, each configuration item record comprising data related to components making up the networked computer system, wherein the configuration management database is accessible by the processor; wherein the security risk module comprises instructions that: receives, via the network interface, external vulnerability data from a source external to the networked computer system regarding vulnerabilities associated with an attack vector for configuration item, CI, data related to a physical device (112, 122), defined as a CI device, of the networked computer system; accesses the CMDB and reads the CI data related to the physical device; determines a trust zone for the CI device from a plurality of trust zones utilizing the CMDB, the trust zones constituting a way for delineating devices based on risk in light of various attack vectors; determines trust zone data associated with the trust zone related to the CI device, wherein the trust zone data comprises data for one or more perimeter defense components; performs a vulnerability calculation for the CI device utilizing the external vulnerability data and the trust zone data associated with the CI device; performs a second vulnerability calculation for a second CI device utilizing the external vulnerability data and the trust zone data associated with the second CI device; compares the vulnerability calculation for the CI device with the second vulnerability calculation for the second CI device; and prioritizes an action to be taken on the CI device or an associated other network component based on the comparison. a processor; a network interface comprising a communications port connected to a network; a memory accessible by the processor and comprising a security risk module that comprises instructions executable by the processor; a configuration management database, CMDB, that comprises a plurality of configuration item records, each configuration item record comprising data related to components making up the networked computer system, wherein the configuration management database is accessible by the processor; wherein the security risk module comprises instructions that: receives, via the network interface, external vulnerability data from a source external to the networked computer system regarding vulnerabilities associated with an attack vector for configuration item, CI, data related to a physical device (112, 122), defined as a CI device, of the networked computer system; accesses the CMDB and reads the CI data related to the physical device; determines a trust zone for the CI device from a plurality of trust zones utilizing the CMDB, the trust zones constituting a way for delineating devices based on risk in light of various attack vectors; determines trust zone data associated with the trust zone related to the CI device, wherein the trust zone data comprises data for one or more perimeter defense components; performs a vulnerability calculation for the CI device utilizing the external vulnerability data and the trust zone data associated with the CI device; performs a second vulnerability calculation for a second CI device utilizing the external vulnerability data and the trust zone data associated with the second CI device; compares the vulnerability calculation for the CI device with the second vulnerability calculation for the second CI device; and prioritizes an action to be taken on the CI device or an associated other network component based on the comparison. receives, via the network interface, external vulnerability data from a source external to the networked computer system regarding vulnerabilities associated with an attack vector for configuration item, CI, data related to a physical device (112, 122), defined as a CI device, of the networked computer system; accesses the CMDB and reads the CI data related to the physical device; determines a trust zone for the CI device from a plurality of trust zones utilizing the CMDB, the trust zones constituting a way for delineating devices based on risk in light of various attack vectors; determines trust zone data associated with the trust zone related to the CI device, performs a vulnerability calculation for the CI device utilizing the external vulnerability data and the trust zone data associated with the CI device; performs a second vulnerability calculation for a second CI device utilizing the external vulnerability data and the trust zone data associated with the second CI device; compares the vulnerability calculation for the CI device with the second vulnerability calculation for the second CI device; and prioritizes an action to be taken on the CI device or an associated other network component based on the comparison.