Determining vulnerability using attach graphs: an expansion of the current FAIR model