Understanding an organization's reliance on information systems and how to mitigate the vulnerabilities of these systems can be an intimidating challenge—especially when considering less well-known weaknesses or even unknown vulnerabilities that have not yet been exploited. The authors introduce the Vulnerability Assessment and Mitigation methodology, a six-step process that uses a top-down approach to protect against future threats and system failures while mitigating current and past threats and weaknesses.