In retail and beyond, reactive security is limited. Exposure-led resilience is now essential.