Measuring Vulnerability
...shaped (i.e., the majority of threat agents fall somewhere below those who are most capable and above those who are least capable
A 100% secure control (if such a thing existed) could be illustrated as existing outside of the threat community capability distribution. It would be 0% vulnerable
More realistically, we can in most cases expect...
