how to do vulnerability management