New methods of looking at exposure management and security control validation enable businesses  to prioritize security investments with business and risk context.