When does a risk not exist? What is a risk to your employer? Many people overlook the largest risks to their organization and mistakenly focus on the most interesting CVSS, Headline, Zero Day, etc. Understanding when risks can be closed out, and prioritizing which ones to tackle and mitigate first is a struggle for many teams, but why is that? Could the key to prioritization be in changing how you view risks and building a vulnerability management program around this new focus?