Stav dette: Finding and fixing vulnerabilities in information systems