From vulnerability management to cyber exposure management