1. A computer-implemented method comprising: receiving an asset topology that identifies an entity's computer-related assets, how the computer-related assets are connected together via one or more networks controlled by the entity, and an identifier for each computer-related asset that is an external facing asset, wherein the asset topology identifies one or more first computer-related assets each of which is an external facing asset and one or more second computer-related assets each of which is not an external facing asset; receiving threat data that identifies vulnerabilities of computer-related assets; determining, using the identifiers for the computer-related assets that may be an entry point for an attack simulation, a first computer-related asset that is one of the first computer-related assets; identifying, using the threat data, one or more first vulnerabilities of the first computer-related asset; determining, using the asset topology and the threat data, a path from the first computer-related asset to a second computer-related asset that is one of the second computer-related assets; determining, using the threat data, one or more second vulnerabilities of the second computer-related asset; determining, using the one or more second vulnerabilities of the second computer-related asset, a probability that the second computer-related asset will be compromised by an adversary's device; determining, using the asset topology and the threat data, a change to the asset topology to reduce the probability that the second computer-related asset will be compromised by an adversary's device; and providing information about the change to the asset topology for presentation to a user or implementing the change to the asset topology.