Understanding and Managing Cyber Risk: Vulnerabilities