Insurance companies can reduce risk with Attack Path Management