You need to understand your security risks in depth to realistically manage them.