1. An electronic computing device comprising: a processing unit; and system memory, the system memory including instructions that, when executed by the processing unit, cause the electronic computing device to: receive a vulnerability; generate a user score for each of a plurality of users within an enterprise, wherein the user score is generated based on a set of characteristics including: behavioral data, user device data, and user status data; generate a threat score for the vulnerability: based on the user score and the threat score, generate a composite score for each of the plurality of users within the enterprise; generate a user rank using the user score generated for each of the plurality of users within the enterprise; acquire the security patch that addresses the vulnerability; and based on the composite score, implement a security measure across the enterprise in a sequential order according to the user rank; wherein implementing the security measure includes publishing the security patch to the plurality of users according to the user rank.