As attackers expand their reach beyond traditional IT infrastructure, organizations must take a broader view of where their risks really lie.