What is the difference between a vulnerability and a threat, and how does Qualys help bridge that gap?