Attack surface management ROI improves when ownership, exposure duration, and risky endpoints decline—not when asset counts ...