Asset discovery tells you what IT exists in your environment. Exposure management tells you what will get you breached. If your platform can't connect vulnerabilities, identities, misconfigurations, ...
A former NHS analyst and convicted child rapist could have used unaudited database queries to profile his victims.