mapping vulnerability