Patent ID: 7962960

Claim:
A method comprising: at a network monitoring system of a computer network that comprises a plurality of network elements, wherein the network monitoring system includes a hardware processing device, receiving a plurality of values that each corresponds to a vulnerability of a network element of the plurality of network elements; storing, at the network monitoring system, information representing exceptions to security rules; scanning, by a scanning device, the plurality of network elements to identify vulnerabilities, the vulnerabilities representing potential points of attack; generating, by said network monitoring system, a risk indicator for each of the network elements based on the scanning and the received plurality of values, the risk indicator representing a relative risk level associated with the corresponding network element; determining, by the network monitoring system and subsequent to the generating a risk indicator, whether an exception to a security rule exists with respect to any of the identified vulnerabilities; adjusting, by the network monitoring system, the risk indicator for a first one of the network elements in response to determining that an exception to a security rule exists with respect to an identified vulnerability associated with the first network element; and providing the risk indicator for each of the network elements to a user device for display.