Why vulnerability management needs a refresh