Vulnerability assessment and attack surface management answer different questions. This article explains the gap between them and how an integrated approach closes it.