CIS will use the Vulnerability Assessment Report in order to find which attacks are possible based on potential vulnerabilities can be compromised. This stage will show the extent of the exposures and their impacts to the system, the information that can be disclosed, altered and services disrupted.