onboarding vulnerability