A new attacker technique is technically possible, but its relevance to the organization is unknown. What should happen before increasing the rating?

1. Adopt the highest media headline score automatically
2. Buy the first advertised countermeasure
3. Validate affected assets, prerequisites, exposure, and existing defenses
4. Ignore it because it has not yet caused an internal incident