1. A computer-implemented method comprising: obtaining, by a vulnerability assessment device, a plurality of unique software identifiers each for a corresponding one of a plurality of executable applications observed at one or more devices separate from the vulnerability assessment device and forming part of an information technology infrastructure; obtaining, by the vulnerability assessment device, global security risk metadata for one or more executable applications observed at the one or more devices; mapping, by the vulnerability assessment device, one or more unique software identifiers to global security risk metadata obtained for one or more executable applications that are identified by the one or more unique software identifiers to generate a vulnerable application dataset; analyzing, by the vulnerability assessment device, the vulnerable application dataset to generate security risk assessment information for the information technology infrastructure; categorizing, by the vulnerability assessment device, each of the one or more devices either as running a vulnerable executable application or as not running the vulnerable executable application; and based on the categorizing, quantifying, by the vulnerability assessment device, a likelihood that the one or more devices that are running the vulnerable executable application could be compromised by computing a ratio of: a number of the one or more of the devices that are running the vulnerable executable application and that are compromised; and a number of the one or more devices that are not running the vulnerable executable application and that are compromised.