Three critical metrics you should expect from a vulnerability risk management solution