Identification should include security vulnerabilities.