Which statement best describes the purpose of vulnerability?

A. a completed user story B. a weakness that can be exploited to harm security C. an approved security control D. a secure configuration baseline