Finding and Fixing Vulnerabilities in Information Systems