understanding system vulnerability