Embracing an all-hazard view to deal with random failures, natural disasters, accidents and malevolent intentional acts, a framework for the vulnerability analysis of safety-critical systems and infras- tructures is set up. A hierarchical structure is used to organise the information on the hazards, which is then manipulated through a decision-making process for vulnerability evaluation. We present the framework and its hierarchical model by way of assessing the susceptibility of a safety-critical system to intentional hazards, con- sidering criteria of diverse nature, such as physical characteristics, social criticality characteristics, exposition to cascading failures, resilience. We use a ranking method to compare systems of different characteristics. The systematic process of analysis is presented with reference to the exemplary case of nuclear power plants.