Revived a state-of-the-art vulnerability management program at a large enterprise—an experience full of surprises and hard lessons. Three key processes made all the difference.