Performing Vulnerability Assessments