How organizations are managing vulnerability risks