Security leaders have invested heavily in vulnerability management programs. Scanners are running. SBOMs are being generated.