Your Critical Vulnerabilities Might Not Be Your Biggest Risk