Gartner: security pros should focus on risk management