Prioritizing Vulnerability in Risk Assessment