cost vulnerability