Relying on a defined risk framework, focusing on competitors' benchmark reports, and examining the approaches others have used to manage risk can be counterproductive, giving adversaries greater leeway in creating attack plans that may evade an organization's defenses