Work-factor View
"Assume that well-funded attacker can penetrate almost any system eventually
"The question is “How long can these defensive measures resist?”
"RV may probabilistically approximate the work factor to crack a system
foo% of native vulnerabilities are not actually exploitable
Therefore foo% of the time a well-funded attacker can’t get in that way
Attacker takes foo% longer to get in???