Techniques are provided for generating activity-based network profiles for devices, and for ranking such devices using the activity-based network profiles. One method comprises evaluating device communications to identify services that communicated with devices of an enterprise; generating an activity-based network profile for each device based on the services that communicated with each respective device; clustering the devices into a plurality of clusters based on a functional characterization of the devices derived from the activity-based network profiles; and ranking the devices within a cluster based on network activity and/or network exposure. The activity-based network profile for a given device: (i) identifies the services that communicated with the given device, (ii) identifies other devices that communicate with a respective service on the given device, and (iii) provides a local fraction metric based on network metrics of the other devices that communicate with the respective service on the given device.