Information security has evolved from safeguarding systems to protecting business services and brands against risk. Senior security executives must closely understand and monitor the level of risk exposure a company has, how the latest threats impact their risk exposure, which system vulnerabilities and access violations represent an actual exploit risk, and what risks will enter into play with new technology and business initiatives.