vulberability scan process