types of vulnerability assessment