how to measure vulnerability