Risk is context. A finding without impact is noise.Start with business flows, assets, and threats, then test with focus.