Addressing security gaps with risk-based vulnerability management