Businesses are taking too long to fix vulnerabilities