A section where you can mark whether a customer is vulnerable or not can be found under the overview tab within the Project information field: