Abstract: Various systems and methods are described for correlating technology choices with the risk of system vulnerabilities. A system captures and quantifies both observations of technology choices as well as the outputs certain outputs of internal choices and processes across a number of different organizations. A Bayesian estimate of vulnerability is imputed from the choices and observed use of vulnerable technology, further segmented by business type, revenue, and size. Differences between the observation of a particular organization and Bayesian expected value are measured and converted to vulnerability score, the vulnerability score embodying a point-in-time and longitudinal measure of organizational performance, including the likelihood of future compromise due to software vulnerabilities. The vulnerability score can then be further used to price risk, for example in a cyber insurance context.