Why you need to run a vulnerability assessment