Why are some organizations vulnerable?