Vulnerabilities on external attack surfaces live far too long