What class of security risk represents an opportunity for hackers when they find an identified weakness in which necessary controls are not present or effective?.