I think they mean what is the actual vulnerability and not the score.