non-IT vulnerabilities