1. A method of quantifying vulnerability of a system, comprising: converting each of a plurality of vulnerability identification results of the system into a vulnerability score so that corresponding vulnerability identification results of the system can be applied to calculation of scores; calculating a target organization security level score corresponding to the system based on a technology-field security level score and a management-field security level score among the vulnerability scores; converting status of a local network of the system being separated from an external network into a network separation score; calculating an interim score based on the target organization security level score and the network separation score; and quantifying the vulnerability of the system by finally calculating a composite score of the system using the interim score and a simulated intrusion success level, wherein calculating the target organization security level score includes: converting technology-related vulnerability results, selected from among the plurality of vulnerability identification results of the system, into the technology-field security level score; and converting management-related vulnerability results, selected from among the vulnerability identification results of the system, into the management-field security level score, and wherein converting technology-related vulnerability results into the technology-field security level score is performed using a sum of scores corresponding to the technology-related vulnerability results and a sum of the vulnerability scores.