Is the inability to baseline systems crippling cybersecurity progress and oversight?

Rather than just guessing where attackers may be or trying to harden systems in a tactical sense, baselining actually operationalizes enterprise risk management.