Complexity, and Authentication, can be useful in understanding how much effort an
attacker needs to exploit a vulnerability, but these fields are not very fine-grained. They
do not capture the relative difficulty and complexity of the associated vulnerability,
which can be an indicator of the maturity of a product relative to its vulnerability history.