vulnerability assessment: what you need to know