particularly chaining vulnerabilities together that may have moderate residual risk in the POA&M but aggregated to high due to the impact would have by being able to exploit multiple from one incompliant configuration??