1. A vulnerability detection and alerting system for detecting compromise of one or more IP devices on an IP network, the system comprising: a detector adapted to detect one or more primitive vulnerability events in the IP devices; and an attribute engine adapted to generate attribute data representing information about the importance of the IP devices.