Work-factor View
"Assume that well-funded attacker can penetrate almost any system eventually
"The question is ÒHow long can these defensive measures resist?Ó
"RV may probabilistically approximate the work factor to crack a system
Ðfoo% of native vulnerabilities are not actually exploitable
ÐTherefore foo% of the time a well-funded attacker canÕt get in that way
ÐAttacker takes foo% longer to get in???