Step 2: Determine vulnerability