Most organizations can see their software security risks. Far fewer can act on them fast enough to matter – and with the EU ...