There are interrelations between various risk factors and propose that decision-makers should identify "interactive risk paths" rather than "independent individual risks" for better simulation of project conditions. This study is an effort to mitigate negligence of previous studies that depend on separate risk categories, generic checklists and one way risk hierarchies and propose an alternative Risk-Path Model. In this model, risk factors, their sources, and their consequences are assumed to be causally dependent. Moreover, within the context of this study, the vulnerability factors inherent in the project environment are assumed to act as the initiatives of the possible risk paths. It is believed that incorporating system's vulnerabilities into the risk-path identification process will lead to more realistic and more accurate estimations about the future since these factors are known with higher level of certainties at early stages of the projects. All the possible interactionsamong diverse identified vulnerability generated risk paths are tested and the cross impacts are estimated employing Structural Equation Modeling (SEM) technique.