KPMG Interview Question

What makes a system vulnerable?