vulnerability analysis