Companies should practise IT vulnerability management to avoid attacks and minimise security costs.