4) Restricted, guest, or anonymous user
Novelty. This considers how new or unusual the vulnerability and associated attack is. If
we assume that software will always have vulnerabilities, then we might reasonably
expect that it will not have vulnerability types that have been known for a long time.