Vulnerability assessment of distributed systems