A computer-implemented method comprising: providing, by a security platform, graph data defining a graph that is representative of an enterprise network , the graph comprising nodes (320; 322) and edges between nodes (320; 322), a set of nodes (320; 322) representing respective assets (122; 124; 126; 128) within the enterprise network , each edge representing at least a portion of one or more lateral movement paths between assets in the enterprise network ; determining, for each asset (122; 124; 126; 128), a criticality of the respective asset (122; 124; 126; 128) to operation of a process, comprising: determining a locality of the respective asset by determining a position of the node (320; 322) that corresponds to the respective asset (122; 124; 126; 128) in the enterprise network , and determining the locality of the asset (122; 124; 126; 128) based on the position of the node (320; 322) that corresponds to the asset (122; 124; 126; 128) in the enterprise network ; determining a lateral movement path between a first node (320; 322) represented by a first asset (122; 124; 126; 128) and a second node (320; 322) represented by a second asset (122; 124; 126; 128) within the graph ; determining, based on the criticality of each of the assets (122; 124; 126; 128) represented by nodes (320; 322) along the lateral movement path, a path value representative of a criticality in preventing an attack through the lateral movement path; and providing an indication of the path value representative of the criticality in preventing an attack through the lateral movement path. providing, by a security platform, graph data defining a graph that is representative of an enterprise network , the graph comprising nodes (320; 322) and edges between nodes (320; 322), a set of nodes (320; 322) representing respective assets (122; 124; 126; 128) within the enterprise network , each edge representing at least a portion of one or more lateral movement paths between assets in the enterprise network ; determining, for each asset (122; 124; 126; 128), a criticality of the respective asset (122; 124; 126; 128) to operation of a process, comprising: determining a locality of the respective asset by determining a position of the node (320; 322) that corresponds to the respective asset (122; 124; 126; 128) in the enterprise network , and determining the locality of the asset (122; 124; 126; 128) based on the position of the node (320; 322) that corresponds to the asset (122; 124; 126; 128) in the enterprise network ; determining a locality of the respective asset by determining a position of the node (320; 322) that corresponds to the respective asset (122; 124; 126; 128) in the enterprise network , and determining the locality of the asset (122; 124; 126; 128) based on the position of the node (320; 322) that corresponds to the asset (122; 124; 126; 128) in the enterprise network ; determining a lateral movement path between a first node (320; 322) represented by a first asset (122; 124; 126; 128) and a second node (320; 322) represented by a second asset (122; 124; 126; 128) within the graph ; determining, based on the criticality of each of the assets (122; 124; 126; 128) represented by nodes (320; 322) along the lateral movement path, a path value representative of a criticality in preventing an attack through the lateral movement path; and providing an indication of the path value representative of the criticality in preventing an attack through the lateral movement path. <EOS>