You have to address the symptoms, remediate the issues at the heart of the problem. if you are to manage cyber risk.