Reachable is not exploitable: layering exposure so prioritization reflects real risk