Still lacking is a governance structure for systems coming online to consider whether they're acting within their design constraints, what they’re doing to networks and the risks they present, says Richard Staynings, chief security strategist at Cylera.