A former NHS analyst and convicted child rapist could have used unaudited database queries to profile his victims.
Asset discovery tells you what IT exists in your environment. Exposure management tells you what will get you breached. If your platform can't connect vulnerabilities, identities, misconfigurations, ...