From exposure management to agentic security: The next step in cyber resilience