Why is risk-based prioritization important when addressing an expanding attack surface?

• A. It focuses resources on the highest-risk areas.
• B. It eliminates all risk immediately.
• C. It ensures Audit completeness across all systems.
• D. It delays remediation indefinitely.

Answer: (A)

When the attack surface expands, you have to decide where to put limited security resources. The main idea is to prioritize by risk—assessing where the chance of a breach is greatest and where the impact would be most severe. By directing remediation and controls to those high-risk areas first, you reduce the overall residual risk most effectively and keep a process that can adapt as new assets appear or threats shift. This approach aligns security efforts with business impact and compliance needs, making progress realistic and scalable rather than trying to fix everything at once. It isn’t about eliminating all risk immediately, nor about achieving audit completeness across every system, and delaying action would leave critical gaps. Focusing on the highest-risk areas provides the most practical and impactful path in an expanding attack surface.