Internal vulnerability assessment