Cyber Risk Management: Why Finding Vulnerabilities Isn’t the Same as Managing Risk A business can run test after test, fix flaw after flaw, and still not actually be managing its cyber risk.