1. A computer-implemented method comprising: obtaining a plurality of unique software identifiers each for a corresponding one of a plurality of executable applications observed at one or more devices forming part of an information technology infrastructure; obtaining global security risk metadata for one or more executable applications observed at the one or more devices; mapping one or more unique software identifiers to global security risk metadata obtained for one or more executable applications that are identified by the one or more unique software identifiers to generate a vulnerable application dataset; and analyzing the vulnerable application dataset to generate security risk assessment information for the information technology infrastructure.