Most security programmes are stronger on discovery than validation. The Exposure Maturity Model identifies exactly which dimension is holding your programme back.