Assessing implementation vulnerabilities