No-notice vulnerability assessments