While backups continue to be essential, they no longer determine preparedness when attackers steal sensitive data and use exposure as the primary pressure point.