Refocusing Vendor Security on Risk Reduction | Not Hacker News!