Rationalize security spend: Exposure management & security validation