The cybersecurity sector is obsessed with measuring risk. We track CVEs, count patches, and calculate compliance scores. And ...