vulnerability gap