From vulnerability formalization to finitely additive probability monads