Add structured exposure and attacker position fields to risk calibration