Semi-quantitative vulnerability assessments