1. A method comprising: determining a first plurality of vulnerabilities of a first computing asset; generating a first risk score for the first computing asset based on the first plurality of vulnerabilities and on one or more contextual factors that a number of available exploits for each vulnerability of the first plurality of vulnerabilities, wherein the number of available exploits includes a first number of available exploits for a first vulnerability and a second number of available exploits for a second vulnerability, wherein the first number of available exploits is different than the second number of available exploits; wherein the method is performed by one or more computing devices.