Most CISOs think they know their automation footprint — until they see it. The real exposure isn’t code, but ungoverned ...