The US GAO’s Equifax findings show how a missed vulnerability becomes a business crisis when identification, detection, segmentation and data governance also fail. ASD, CISA, NIST, NCSC and APRA guidance show why leaders must connect continuous vulnerability assessment to critical services, accountable decisions and tested recovery.