The Art of Vulnerability Management: from Running Scans to Managing Risk