A model to evaluate upstream vulnerability