1. A computer-implemented method comprising: receiving an asset topology that identifies an entity's computer related assets, how the computer related assets are connected together via one or more networks controlled by the entity, and an identifier for each computer related asset that is an external facing asset, wherein the asset topology identifies one or more first computer related assets each of which is an external facing asset and one or more second computer related assets each of which is not an external facing asset; receiving threat data that identifies vulnerabilities of computer related assets; determining, using the identifiers for the computer related assets that may be an entry point for an attack simulation, a first computer related asset that is one of the first computer related assets; identifying, using the threat data, one or more first vulnerabilities of the first computer related asset; determining, using the asset topology and the threat data, a path from the first computer related asset to a second computer related asset that is one of the second computer related assets; determining, using the threat data, one or more second vulnerabilities of the second computer related asset; determining, using the one or more second vulnerabilities of the second computer related asset, a probability that the second computer related asset will be compromised by an adversary's device; determining, using the asset topology and the threat data, a change to the asset topology to reduce the probability that the second computer related asset will be compromised by an adversary's device; and providing information about the change to the asset topology for presentation to a user or implementing the change to the asset topology.