A computer-implemented method for prioritizing remediations in systems of an enterprise, the method being executed by one or more processors and comprising: providing, by a security platform, graph data defining a graph that is representative of an enterprise network , the graph comprising nodes (320; 322) and edges between nodes (320; 322), a set of nodes (320; 322) representing respective assets (122; 124; 126; 128) within the enterprise network , each edge representing at least a portion of one or more lateral movement paths between assets (122; 124; 126; 128) in the enterprise network ; selecting a process from a set of processes that are included in the enterprise network ; determining, for each asset (122; 124; 126; 128), a contribution value indicating a contribution of a respective asset (122; 124; 126; 128) to operation of the selected process; determining two or more lateral movement paths between a first asset (122; 124; 126; 128) and a second asset (122; 124; 126; 128) within the graph ; providing, for each lateral movement path, a lateral movement path value representative of a difficulty in traversing a respective lateral movement path within the enterprise network , wherein each lateral movement path value is determined based on at least one lateral movement complexity value of respective segments of the lateral movement path and a preconditioned action; identifying a set of remediations based on two or more remediations defined for one or more vulnerabilities associated with issues identified for respective assets (122; 124; 126; 128), each remediation mitigating a cyber-security risk within the enterprise network ; and prioritizing the two or more remediations based on contribution values of assets (122; 124; 126; 128), lateral movement path values of paths, and lateral movement complexity values of respective segments of paths. providing, by a security platform, graph data defining a graph that is representative of an enterprise network , the graph comprising nodes (320; 322) and edges between nodes (320; 322), a set of nodes (320; 322) representing respective assets (122; 124; 126; 128) within the enterprise network , each edge representing at least a portion of one or more lateral movement paths between assets (122; 124; 126; 128) in the enterprise network ; selecting a process from a set of processes that are included in the enterprise network ; determining, for each asset (122; 124; 126; 128), a contribution value indicating a contribution of a respective asset (122; 124; 126; 128) to operation of the selected process; determining two or more lateral movement paths between a first asset (122; 124; 126; 128) and a second asset (122; 124; 126; 128) within the graph ; providing, for each lateral movement path, a lateral movement path value representative of a difficulty in traversing a respective lateral movement path within the enterprise network , wherein each lateral movement path value is determined based on at least one lateral movement complexity value of respective segments of the lateral movement path and a preconditioned action; identifying a set of remediations based on two or more remediations defined for one or more vulnerabilities associated with issues identified for respective assets (122; 124; 126; 128), each remediation mitigating a cyber-security risk within the enterprise network ; and prioritizing the two or more remediations based on contribution values of assets (122; 124; 126; 128), lateral movement path values of paths, and lateral movement complexity values of respective segments of paths. <EOS>