A tangible, non-transitory, machine-readable-medium, comprising machine-readable instructions that, when executed by a processor, cause the processor to perform acts comprising:
- receive a solution graph associating vendor solutions with a plurality of vulnerabilities of a plurality of configuration items, wherein the plurality of configuration items comprise one or more client networks, one or more client devices communicatively coupled to the one or more client networks, or both;
- and
- evaluate a risk associated with one or more vulnerabilities of the plurality of vulnerabilities that are associated with a vendor solution