Assessing the vulnerability of SMEs: a qualitative analysis