1. A method comprising: identifying an asset with at least one vulnerability risk; identifying at least one service running on at least one port on the asset; identifying at least one connection to the at least one port; calculating an operational dependence role of the asset as a function of the at least one service and the at least one connection; and modifying the vulnerability risk based on the operational dependence role.