Employees know vulnerabilities exist, but they can’t resolve them quickly enough