Vulnerability assessment (target susceptibility)

Vulnerability assessment is a dual-use analytical method for determining where a state, institution or system is susceptible to economic pressure or disruption: where dependence is deep, substitution is hard and buffers are limited. It can support resilience planning as well as coercive targeting. In the proposed FININT workflow, it converts network maps into a judgement about likely sensitivity and adaptive capacity.

Mechanism

A practical assessment tests several distinct forms of exposure: legal jurisdiction, market access, supply-chain rigidity, financial buffers, political alternatives and reputational sensitivity. It then tests substitution and adaptation against each one. A target that can reroute trade, mobilise reserves or secure new partners may remain exposed without being susceptible. The categories are an editorial synthesis informed by targeting, assessment and risk practice, not a validated causal scale.

Application

Vulnerability assessment sits between chokepoint identification and tool selection in the FININT workflow, and can inform reconnaissance. The Qatar blockade is a cautionary example: visible border, funding and currency exposures coexisted with reserves, substitute supply routes and diplomatic alternatives. Public evidence does not establish what coalition planners assessed beforehand, so the case shows the difference between observable exposure and demonstrated susceptibility rather than proving a forecasting error.

Limits

Susceptibility is dynamic. Targets that anticipate pressure harden the assessed axes, accumulating gold, de-dollarising trade and building parallel rails, so assessments decay quickly and must be re-run as continuously as the reconnaissance that feeds them.

The assessment is an enabling method, not an attack. It must distinguish exposure, sensitivity and adaptive capacity, identify substitute suppliers and financing, and state uncertainty, counterfactual and civilian spillover. Observable dependence does not establish that a sender can exploit it or that the target lacks reserves, policy options or partners. The inherited Qatar figures are therefore not used as proof of coalition foresight. Case evidence must state its date and denominator before supporting a susceptibility judgement.

See also

Financial intelligence (FININT) · Chokepoint identification · Tool selection and sequencing · Reconnaissance (EKC Phase 1) · Economic Kill Chain (EKC) · Supply-chain resilience · Economic statecraft

Sources

• Joint Chiefs of Staff, *Joint Publication 3-60: Joint Targeting*.
• Joint Staff, *Assessment and Risk* focus paper.
• International Organization for Standardization, ISO 31000 risk-management overview.
• National Institute of Standards and Technology, Cybersecurity Supply Chain Risk Management Practices.