evidence-based vulnerability management