The State of Attack Path Management