vulnerability theory