New attack surfaces, a changed threat model, and the governance moves that don't stall the business.