Identifying and updating security gaps