Security Scanning is not Risk Analysis