1. A computer-implemented method for generating an attack graph, the computer-implemented method comprising: identifying, by a computer, a set of sensitive data corresponding to a regulated service; scanning, by the computer, for a set of components corresponding to the regulated service that are authorized to perform activities associated with sensitive data; identifying, by the computer, vulnerability and risk metrics corresponding to each component in the set of components of the regulated service; and generating, by the computer, the attack graph that includes nodes representing components in the set of components of the regulated service and edges between nodes representing relationships between related components in the set of components based on the vulnerability and risk metrics corresponding to each component in the set of components.