internal vulnerability assessment