IT vulnerability assessment