In cybersecurity, conflating control gaps with risks is a common error that muddies threat modeling, vulnerability management, and compliance efforts.