Embrace cyber-risk modeling and ask security teams to pinpoint the risks that matter and prioritize remediation efforts.