Do vulnerability management measures have a data problem?