To assess what vulnerabilities exist, and how to get rid of a vulnerability or mitigate its risk. Vulnerabilities apply not only to software, but also to hardware, networking, physical access and the social/psychological realm.