A computer-implemented method for prioritizing remediations in systems of an enterprise, the method being executed by one or more processors and comprising: providing, by a security platform, graph data defining a graph that is representative of an enterprise network, the graph comprising nodes (320; 322) and edges between nodes (320; 322), a set of nodes (320; 322) representing respective assets (122; 124; 126; 128) within the enterprise network, each edge representing at least a portion of one or more lateral movement paths between assets (122; 124; 126; 128) in the enterprise network; selecting a process from a set of processes that are included in the enterprise network; determining, for each asset (122; 124; 126; 128), a contribution value indicating a contribution of a respective asset (122; 124; 126; 128) to operation of the selected process; determining two or more lateral movement paths between a first asset (122; 124; 126; 128) and a second asset (122; 124; 126; 128) within the graph; providing, for each lateral movement path, a lateral movement path value representative of a difficulty in traversing a respective lateral movement path within the enterprise network, wherein each lateral movement path value is determined based on at least one lateral movement complexity value of respective segments of the lateral movement path and a preconditioned action; identifying a set of remediations based on two or more remediations defined for one or more vulnerabilities associated with issues identified for respective assets (122; 124; 126; 128), each remediation mitigating a cyber-security risk within the enterprise network; and prioritizing the two or more remediations based on contribution values of assets (122; 124; 126; 128), lateral movement path values of paths, and lateral movement complexity values of respective segments of paths. providing, by a security platform, graph data defining a graph that is representative of an enterprise network, the graph comprising nodes (320; 322) and edges between nodes (320; 322), a set of nodes (320; 322) representing respective assets (122; 124; 126; 128) within the enterprise network, each edge representing at least a portion of one or more lateral movement paths between assets (122; 124; 126; 128) in the enterprise network; selecting a process from a set of processes that are included in the enterprise network; determining, for each asset (122; 124; 126; 128), a contribution value indicating a contribution of a respective asset (122; 124; 126; 128) to operation of the selected process; determining two or more lateral movement paths between a first asset (122; 124; 126; 128) and a second asset (122; 124; 126; 128) within the graph; providing, for each lateral movement path, a lateral movement path value representative of a difficulty in traversing a respective lateral movement path within the enterprise network, wherein each lateral movement path value is determined based on at least one lateral movement complexity value of respective segments of the lateral movement path and a preconditioned action; identifying a set of remediations based on two or more remediations defined for one or more vulnerabilities associated with issues identified for respective assets (122; 124; 126; 128), each remediation mitigating a cyber-security risk within the enterprise network; and prioritizing the two or more remediations based on contribution values of assets (122; 124; 126; 128), lateral movement path values of paths, and lateral movement complexity values of respective segments of paths.