Pairing threats with vulnerabilities