The fastest way to shrink vulnerability risk is to identify what is exposed, then cut the time it stays exposed.