Using Attack Surface Entry Points and Reachability Analysis to Assess the Risk of Software Vulnerability Exploitability