RISK-BASED VULNERABILITY MANAGEMENT