Why benefits of vulnerability assessment cannot be undermined by enterprises