Custom vulnerability management policy