vulnerability assessment method