Rather than talking in terms of attack vectors and vulnerabilities, CISOs and security decision-makers must look at actual business risk.