73% of SCA users lack visibility into whether flagged vulnerabilities are exploitable in production.