PCI compliance alone isn't a risk management strategy. Target's breach showed the gap between passing audits and maintaining effective security controls daily.