1. A vulnerability that presents itself very rarely

2. If it presents itself, it is fatal to the organization

So, few targets are affected, but the outsized effect means that the overall economic impact is not insignificant. How does one keep track of that?

One method is to use a sort of "kirchhoff's law" approach, similar to google page rank. The electrical analogy would be:

- the attacker has a high potential, let's say 1000V. that attacker is the root of a rose tree, going from top to bottom, branching out towards the bottom.

- nodes impossible to exploit present edges with infinite resistance

- nodes that can be exploited present finite resistance (perhaps very low)

- once a node is exploited, its node branches out to other things that now become accessible and may or may not be exploited

- real economic impact presents a connection to ground, measured as 1/($economic impact) ohms resistance

Once you have a structure like that, you can measure the hypothetical current that would be flowing, and measure the severity of such exploits.

Sometimes a single path through a complex system can blow up vital, important parts, and this could be one way to measure it in some sort of objective manner.