Abstract: Systems and methods of assessing vulnerability or risk associated with a computer technology are presented. The system and method may include receiving a listing of vulnerability occurrences associated with the computer technology and determining a severity of each of the vulnerability occurrences. The number of occurrences and severity may be combined to determine a vulnerability security score which provides an objective measure of the risk or vulnerability of the computer technology based on historical data. The vulnerability security score may then be used to make risk based decisions regarding implementation of the computer technology, elimination of use of the technology, and the like.