What are three security blind spots that must be addressed? (Choose three.)

IT is too broad a category to represent a discrete security blind spot - it encompasses the entire technology environment rather than a specific area lacking security visibility.

Workloads, while important to protect, are not listed as one of the three primary blind spots in this framework; their security concerns largely overlap with the application and data categories.

Applications are a blind spot because vulnerabilities in custom-built or third-party software are frequently exploited and often fall outside the visibility of traditional perimeter defenses, requiring dedicated application security controls.

Networks represent a blind spot when east-west (lateral) traffic inside the data center is not inspected, allowing attackers who have breached the perimeter to move freely between internal systems without detection.

Email is a major attack vector and requires security controls, but it is not classified as one of the three core blind spots in this particular security framework.

Data is a blind spot when organizations lack visibility into where sensitive data resides, how it flows across environments, and whether it is being accessed or exfiltrated, making data loss prevention and classification essential.