vulnerability check first