Rethinking Identity Risk: A Strategic Approach to Attack Path Management