Stop treating your vulnerability program like an audit checklist, and start treating it like the real-time risk management ...