Which of the following is the MOST effective approach for tracking vulnerabilities in an organization’s systems and applications?