Threat and vulnerability analysis