operational vulnerability