beyond defining vulnerability