1. A device comprising: a communication interface 130 configured to: receive one or more business service models from a configuration management database 210 , wherein the one or more business service models each comprises a set of configuration items wherein the configuration items comprise IT assets, and wherein the one or more business service models each indicate a type of configuration item and a connectivity of the configuration item; a computer configured to: send the set of configuration items to a vulnerability assessment tool 220 ; receive, a vulnerability score for each configuration item within the set of configuration items; determine an overall business service vulnerability score for each of one or more business services based on the one or more business service models and the vulnerability scores; wherein determining the overall business service vulnerability score comprises generating a weight based on a technology type and a topology type of each configuration item, and summing the product of the vulnerability score and a weight for each configuration item over all configuration items; and output electronically the overall business service vulnerability score.