Explaining a Security Vulnerability to a Non-Technical Stakeholder