A method for improving utilization of network devices, comprising: detecting that a first network device is added to a first network system associated with a first service map, wherein the first service map comprises a first representation of a first plurality of network devices utilized to perform one or more activities of a first workflow for a first service; determining one or more sensor attributes of the first network device that are associated with respective key performance indicators for a first activity of the one or more activities; updating the first service map to include a representation of the first network device to indicate that the one or more determined sensor attributes provide input for the first activity; determining that the first network device is compromised, wherein determining that the first network device is compromised comprises determining that the first network device is vulnerable to a security threat based on data produced by the first network device; and in response to determining that the first network device is vulnerable to a security threat: identifying a device type of the first network device; identifying a second network device in a second network system having the device type, wherein the second network system is associated with a second service map comprising a second representation of a second plurality of network devices utilized to perform one or more activities of a second workflow for a second service; implementing a security measure on the second network device based on a type of compromise affecting the first network device; and updating the second service map to indicate a health measure associated with the second network device based on the type of compromise. detecting that a first network device is added to a first network system associated with a first service map, wherein the first service map comprises a first representation of a first plurality of network devices utilized to perform one or more activities of a first workflow for a first service; determining one or more sensor attributes of the first network device that are associated with respective key performance indicators for a first activity of the one or more activities; updating the first service map to include a representation of the first network device to indicate that the one or more determined sensor attributes provide input for the first activity; determining that the first network device is compromised, wherein determining that the first network device is compromised comprises determining that the first network device is vulnerable to a security threat based on data produced by the first network device; and in response to determining that the first network device is vulnerable to a security threat: identifying a device type of the first network device; identifying a second network device in a second network system having the device type, wherein the second network system is associated with a second service map comprising a second representation of a second plurality of network devices utilized to perform one or more activities of a second workflow for a second service; implementing a security measure on the second network device based on a type of compromise affecting the first network device; and updating the second service map to indicate a health measure associated with the second network device based on the type of compromise. identifying a device type of the first network device; identifying a second network device in a second network system having the device type, wherein the second network system is associated with a second service map comprising a second representation of a second plurality of network devices utilized to perform one or more activities of a second workflow for a second service; implementing a security measure on the second network device based on a type of compromise affecting the first network device; and updating the second service map to indicate a health measure associated with the second network device based on the type of compromise.