SECURITY AUDITING : EXPOSING VULNERABILITIES BEFORE THEY'RE EXPLOITED